Detections
Analytics
Claroline add_course.php Multiple Parameter XSS
medium Nessus Plugin ID 16318
Language:
Synopsis
The remote host contains a PHP script that is prone to cross-site scipting attacks.Description
The remote version of Claroline fails to sanitize user input to several parameters of the 'add_course.php' script. Using a specially crafted URL, an attacker may be able to exploit this issue to perform cross-site scripting attacks against users of the affected application.Solution
Upgrade as necessary to Claroline 1.5.3 and apply the claroline153fix01.zip patch referenced in the advisory above.See Also
https://secuniaresearch.flexerasoftware.com/advisories/14131/
Plugin Details
Severity: Medium
ID: 16318
File Name: claroline_xss.nasl
Version: 1.18
Type: remote
Family: CGI abuses : XSS
Published: 2/8/2005
Updated: 1/19/2021
Supported Sensors: Nessus
Vulnerability Information
Required KB Items: www/claroline
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 2/4/2005
Reference Information
BID: 12449