CVE-2006-2286
Dokeos < 1.6.3 and Community Release 2.0.3 - Remote Code Execution via PHP File Inclusion
Title source: llmDescription
Multiple PHP remote file inclusion vulnerabilities in claro_init_global.inc.php in Dokeos 1.6.3 and earlier, and Dokeos community release 2.0.3, allow remote attackers to execute arbitrary PHP code via a URL in the (1) rootSys and (2) clarolineRepositorySys parameters, and possibly the (3) lang_path, (4) extAuthSource, (5) thisAuthSource, (6) main_configuration_file_path, (7) phpDigIncCn, and (8) drs parameters to (a) testheaderpage.php and (b) resourcelinker.inc.php.
References (5)
Core 5
Core References
Various Sources x_refsource_confirm
http://www.dokeos.com/forum/viewtopic.php?t=6848
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2006/1303
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/25740
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/19576
Third Party Advisory x_refsource_confirm
http://www.dokeos.com/wiki/index.php/Security
Scores
EPSS
0.0151
EPSS Percentile
71.3%
Details
CWE
CWE-94
Status
published
Products (2)
dokeos/dokeos
< 1.6.3
dokeos/dokeos_community_release
2.0.3
Published
May 10, 2006
Tracked Since
Feb 18, 2026