CVE-2008-0850

This exploit demonstrates a SQL injection vulnerability in Dokeos versions prior to 1.8.4 SP2. The provided URL manipulates the 'id' parameter in 'whoisonline.php' to extract database information such as user credentials and version details.

The provided text describes multiple vulnerabilities in Dokeos, including SQL injection, XSS, and arbitrary file upload, but does not contain functional exploit code. It includes a sample HTTP request with a malformed Referer header, likely demonstrating an injection point.

The provided text describes multiple vulnerabilities in Dokeos, including SQL injection, XSS, and arbitrary file upload, but does not contain executable exploit code. It references a URL parameter for SQL injection but lacks a functional PoC.

This exploit demonstrates a SQL injection vulnerability in Dokeos by sending a malformed POST request to the course creation endpoint. The payload targets the 'tutor_name' parameter with a single quote to break the SQL query.