20050427 ZRCSA-200501 - Multiple vulnerabilities in Clarolinemailing list
http://marc.info/?l=bugtraq&m=111464607103407&w=2 CVE-2005-1374
Claroline 1.5/1.6 - 'toolaccess_details.php?tool' Cross-Site Scripting
Record summary
CVE-2005-1374 has a selected CVSS score of 6.8; EIP currently links 3 catalogued exploits.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to inject arbitrary web script or HTML via (1) exercise_result.php, (2) exercice_submit.php, (3) agenda.php, (4) learningPathList.php, (5) learningPathAdmin.php, (6) learningPath.php, (7) userLog.php, (8) tool parameter to toolaccess_details.php, (9) data parameter to user_access_details.php, or (10) coursePath parameter to myagenda.php.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 3
Proofs of concept
3Catalogued exploits
ExploitDBClaroline 1.5/1.6 - 'toolaccess_details.php?tool' Cross-Site ScriptingExploitDB exploitby Sieg FriedNot analyzed1 file
ExploitDBClaroline 1.5/1.6 - 'user_access_details.php?data' Cross-Site ScriptingExploitDB exploitby Sieg FriedNot analyzed1 file
ExploitDBClaroline 1.5/1.6 - 'myagenda.php?coursePath' Cross-Site ScriptingExploitDB exploitby Sieg FriedNot analyzed1 file
References
815161Third-party advisory
http://secunia.com/advisories/15161 15725Third-party advisory
http://secunia.com/advisories/15725 1013822vdb entry
http://securitytracker.com/id?1013822 claroline.netConfirmation
http://www.claroline.net/news.php 13407vdb entry
http://www.securityfocus.com/bid/13407 claroline-multiple-scripts-xss(20295)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/20295 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2005-1374