CVE-2008-0850 Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonline.php, (2) tracking_list_coaches_column parameter....
HighCVSS 7.5
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonline.php, (2) tracking_list_coaches_column parameter to main/mySpace/index.php, (3) tutor_name parameter to main/create_course/add_course.php, the (4) Referer HTTP header to index.php, and the (5) X-Fowarded-For HTTP header to main/admin/class_list.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dokeos | = 1.8.4 | No fix listed |
References
- projects.dokeos.com
- 28974 third-party-advisory vendor-advisory
- 3687 third-party-advisory
- 20080219 [DSECRG-08-015] Multiple Security Vulnerabilities in Dokeos 1.8.4 mailing-list
- 27792 vdb-entry
- 1019425 vdb-entry
- ADV-2008-0587 vdb-entry