CVE-2006-1595
Claroline < 1.7.4 - Cross-Site Scripting and Arbitrary File Read via rqmkhtml.php File Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2006-1595. PoCs published by rgod.
AI-analyzed exploit summary The exploit describes an information disclosure vulnerability in Claroline due to improper input sanitization, allowing attackers to retrieve arbitrary files via a crafted URL. No actual exploit code is provided, only a description and example URL.
Description
Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers to read arbitrary files via ".." sequences in the file parameter in a rqEditHtml command.
Exploits (3)
The exploit describes an information disclosure vulnerability in Claroline due to improper input sanitization, allowing attackers to retrieve arbitrary files via a crafted URL. No actual exploit code is provided, only a description and example URL.
The provided text describes a cross-site scripting (XSS) vulnerability in Claroline, where user-supplied input is not properly sanitized. The issue allows arbitrary script execution in the context of the affected site, potentially leading to credential theft.
This exploit targets Claroline <= 1.7.4 via a remote command execution vulnerability in 'scormExport.inc.php' due to unsafe file inclusion when 'register_globals' and 'allow_url_fopen' are enabled. It crafts an HTTP request to include a malicious remote PHP script, executing arbitrary commands.