CVE-2006-4844 PHP remote file inclusion vulnerability in inc/claro_init_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other products, allows remote attackers to execute arbitrary PHP....
MediumCVSS 5.1
EPSS 10.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
PHP remote file inclusion vulnerability in inc/claro_init_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the extAuthSource[newUser] parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| claroline | <= 1.7.7 | No fix listed |
| claroline | = 1.2 | No fix listed |
| claroline | = 1.3 | No fix listed |
| claroline | = 1.4 | No fix listed |
| claroline | = 1.5 | No fix listed |
| claroline | = 1.5.3 | No fix listed |
| claroline | = 1.5.4 | No fix listed |
| claroline | = 1.6 | No fix listed |
| claroline | = 1.6_beta | No fix listed |
| claroline | = 1.6_rc1 | No fix listed |
| claroline | = 1.7 | No fix listed |
| claroline | = 1.7.1 | No fix listed |
| claroline | = 1.7.2 | No fix listed |
| claroline | = 1.7.3 | No fix listed |
| claroline | = 1.7.4 | No fix listed |
| claroline | = 1.7.5 | No fix listed |
| claroline | = 1.7.6 | No fix listed |
| dokeos open source learning and knowledge management tool | = 1.4 | No fix listed |
| dokeos open source learning and knowledge management tool | = 1.5 | No fix listed |
| dokeos open source learning and knowledge management tool | = 1.5.3 | No fix listed |
| dokeos open source learning and knowledge management tool | = 1.5.4 | No fix listed |
| dokeos open source learning and knowledge management tool | = 1.5.5 | No fix listed |
| dokeos open source learning and knowledge management tool | = 1.6.4 | No fix listed |
| dokeos open source learning and knowledge management tool | = 1.6.4_p1 | No fix listed |
| dokeos open source learning and knowledge management tool | = 1.6.5 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| dokeos open source learning and knowledge management tool | = 1.6_rc2 | No fix listed |
References
- 21931 exploit patch third-party-advisory vendor-advisory
- 21948 third-party-advisory vendor-advisory
- www.claroline.net patch
- www.gulftech.org exploit
- www.gulftech.org
- 20056 patch vdb-entry
- ADV-2006-3638 vdb-entry vendor-advisory
- ADV-2006-3639 vdb-entry vendor-advisory
- claroline-claro-file-include(28943) vdb-entry