Dokeos 'My production' Arbitrary File Upload Vulnerability

Bugtraq ID:	26940
Class:	Input Validation Error
CVE:	CVE-2007-6479
Remote:	Yes
Local:	No
Published:	Dec 19 2007 12:00AM
Updated:	May 07 2015 05:34PM
Credit:	RoMaNcYxHaCkEr is credited with the discovered this issue.
Vulnerable:	Dokeos Open Source Learning & Knowledge Management Tool 1.8.4
Not Vulnerable:

Dokeos 'My production' Arbitrary File Upload Vulnerability

Dokeos is prone to a vulnerability that lets attackers upload arbitrary files because it fails to adequately sanitize user-supplied input.

NOTE: To exploit this issue, an attacker must have authenticated access to the affected application.

An attacker can exploit this issue to upload arbitrary files and execute malicious code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects Dokeos 1.8.4; other versions may also be affected.

Dokeos 'My production' Arbitrary File Upload Vulnerability

Attackers may exploit this issue via a browser.

Dokeos 'My production' Arbitrary File Upload Vulnerability

Solution:
The vendor is working on a patch for this issue. The patch will be released on December 25. Please see the references for more information.

Dokeos 'My production' Arbitrary File Upload Vulnerability

References:

• Dokeos Homepage (Dokeos)
  
• Re: [HSC] Dokeos Multiple Cross-Site Scripting Vulnerabilities ([email protected])