CVE-2006-1595

Claroline < 1.7.4 - Cross-Site Scripting and Arbitrary File Read via rqmkhtml.php File Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2006-1595. PoCs published by rgod.

AI-analyzed exploit summary The exploit describes an information disclosure vulnerability in Claroline due to improper input sanitization, allowing attackers to retrieve arbitrary files via a crafted URL. No actual exploit code is provided, only a description and example URL.

Description

Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers to read arbitrary files via ".." sequences in the file parameter in a rqEditHtml command.

Exploits (3)

exploitdb WRITEUP VERIFIED
by rgod · textwebappsphp
https://www.exploit-db.com/exploits/27548

The exploit describes an information disclosure vulnerability in Claroline due to improper input sanitization, allowing attackers to retrieve arbitrary files via a crafted URL. No actual exploit code is provided, only a description and example URL.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Theoretical
Target: Claroline versions 1.7.4 and prior
No auth needed
Prerequisites: Access to the vulnerable Claroline instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by rgod · textwebappsphp
https://www.exploit-db.com/exploits/27549

The provided text describes a cross-site scripting (XSS) vulnerability in Claroline, where user-supplied input is not properly sanitized. The issue allows arbitrary script execution in the context of the affected site, potentially leading to credential theft.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Claroline (version not specified)
No auth needed
Prerequisites: Access to the vulnerable Claroline instance
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by rgod · phpwebappsphp
https://www.exploit-db.com/exploits/1627

This exploit targets Claroline <= 1.7.4 via a remote command execution vulnerability in 'scormExport.inc.php' due to unsafe file inclusion when 'register_globals' and 'allow_url_fopen' are enabled. It crafts an HTTP request to include a malicious remote PHP script, executing arbitrary commands.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Claroline <= 1.7.4
No auth needed
Prerequisites: register_globals = On · allow_url_fopen = On · remote malicious PHP script hosted by attacker
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (9)

Core 9
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/17344
Exploit, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19461
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/24284
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/1187
Exploit vdb-entry x_refsource_osvdb
http://www.osvdb.org/24285
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/1627
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/25562

Scores

EPSS 0.0534
EPSS Percentile 91.6%

Details

Status published
Products (8)
claroline/claroline 1.5
claroline/claroline 1.5.3
claroline/claroline 1.5.4
claroline/claroline 1.6
claroline/claroline 1.6_beta
claroline/claroline 1.6_rc1
claroline/claroline 1.7.2
claroline/claroline < 1.7.4
Published Apr 03, 2006
Tracked Since Feb 18, 2026