Detections
Analytics
Claroline < 1.5.4 / 1.6.0 Multiple Vulnerabilities (RFI, SQLi, XSS, Traversal)
high Nessus Plugin ID 18165
Language:
Synopsis
The remote web server contains a PHP application that is prone to a variety of attacks.Description
The version of Claroline (an open source, collaborative learning environment) installed on the remote host suffers from a number of remotely-exploitable vulnerabilities, including:- Multiple Remote File Include Vulnerabilities Four scripts let an attacker read arbitrary files on the remote host and possibly even run arbitrary PHP code, subject to the privileges of the web server user.
- Multiple SQL Injection Vulnerabilities Seven scripts let an attacker inject arbitrary input into SQL statements, potentially revealing sensitive data or altering them.
- Multiple Cross-Site Scripting Vulnerabilities An attacker can pass arbitrary HTML and script code through any of 10 flawed scripts and potentially have that code executed by a user's browser in the context of the affected website.
- Multiple Directory Traversal Vulnerabilities By exploiting flaws in 'claroline/document/document.php' and 'claroline/learnPath/insertMyDoc.php', project leaders (teachers) are able to upload files to arbitrary folders or copy/move/delete (then view) files of arbitrary folders.
Solution
Upgrade to Claroline version 1.5.4 / 1.6.0 or later.See Also
Plugin Details
Severity: High
ID: 18165
File Name: claroline_mult_vulns.nasl
Version: 1.23
Type: remote
Family: CGI abuses
Published: 4/29/2005
Updated: 6/1/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
Required KB Items: www/claroline
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 4/27/2005
Reference Information
CVE: CVE-2005-1374, CVE-2005-1375, CVE-2005-1376, CVE-2005-1377
BID: 13407