CVE-2008-0851 Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to inscription.php, (2) courseCode para...
MediumCVSS 4.3
EPSS 4.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to inscription.php, (2) courseCode parameter to main/calendar/myagenda.php, (3) category parameter to main/admin/course_category.php, (4) message parameter to main/admin/session_list.php in a show_message action, and (5) an avatar image to main/auth/profile.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dokeos e-learning system | = 1.8.4 | No fix listed |
References
- projects.dokeos.com exploit
- 28974 patch third-party-advisory vendor-advisory
- 3687 third-party-advisory
- 20080219 [DSECRG-08-015] Multiple Security Vulnerabilities in Dokeos 1.8.4 mailing-list
- 27792 vdb-entry
- 1019425 vdb-entry
- ADV-2008-0587 vdb-entry