Dokeos Multiple Remote Input Validation Vulnerabilities
BID:34928
Info
Dokeos Multiple Remote Input Validation Vulnerabilities
| Bugtraq ID: | 34928 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 13 2009 12:00AM |
| Updated: | May 13 2009 07:56PM |
| Credit: | Russ McRee and Gerendi Sandor Attila |
| Vulnerable: |
Dokeos Dokeos 1.8.5 |
| Not Vulnerable: | |
Discussion
Dokeos Multiple Remote Input Validation Vulnerabilities
Dokeos is prone to multiple input-validation vulnerabilities ,including SQL-injection, HTML-injection, cross-site scripting, and cross-site request-forgery issues.
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, obtain sensitive information, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, perform certain unauthorized actions in the context of a user, access or modify data, or exploit latent vulnerabilities in the underlying database.
Dokeos 1.8.5 is affected; prior versions may also be affected.
Dokeos is prone to multiple input-validation vulnerabilities ,including SQL-injection, HTML-injection, cross-site scripting, and cross-site request-forgery issues.
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, obtain sensitive information, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, perform certain unauthorized actions in the context of a user, access or modify data, or exploit latent vulnerabilities in the underlying database.
Dokeos 1.8.5 is affected; prior versions may also be affected.
Exploit / POC
Dokeos Multiple Remote Input Validation Vulnerabilities
Attackers can exploit these issues via a browser. To exploit a cross-site scripting issue or a cross-site request-forgery issue, an attacker must entice an unsuspecting user to follow a malicious URI.
Attackers can exploit these issues via a browser. To exploit a cross-site scripting issue or a cross-site request-forgery issue, an attacker must entice an unsuspecting user to follow a malicious URI.
Solution / Fix
Dokeos Multiple Remote Input Validation Vulnerabilities
Solution:
The vendor has released updates. Please see the references for details.
Solution:
The vendor has released updates. Please see the references for details.
References
Dokeos Multiple Remote Input Validation Vulnerabilities
References:
References:
- Dokeos 1.8 - Security (Dokeos)
- Dokeos Homepage (Dokeos)
- HIO-2009-0416 Dokeos 1.8.5 Multiple Vulnerabilities (HolisticInfoSec.org)