Dokeos Multiple Cross-Site Scripting Vulnerabilities

2007.12.23

Credit: Doz

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2007-6574

CWE: CWE-79

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

 [HSC] Dokeos Multiple Cross-Site Scripting Vulnerabilities

Dokeos is a learning management
system<http://www.hackerscenter.com/archive/view.asp?id=28135#>used to
manage e-learning. It's prone to
cross-site scripting vulnerability. An attacker may leverage this issue to
have
arbitrary script code execute in the browser of an unsuspecting user in the
context of the affected site. This may help the attacker steal cookie-based
authentication credentials and launch other attacks.

Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Doz

Risk: Medium
Class: Input Validation Error
Remote: YES
Local: N/A

Vendor: Dokeos http://www.dokeos.com/
Product: Dokeos 1.8.4 & Previous

* Attackers can exploit these issues via a web client.

Exploit Path:

/main/forum/viewforum.php?cidReq=[Forum-ID]&forum=XSS
/main/forum/viewthread.php?forum=XSS

/main/work/work.php?cidReq=[Forum-ID]&curdirpath=
/&display_upload_form=true&origin=XSS

Google Search:

google:allinurl:"/auth/lostPassword.php"

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Dokeos Multiple Cross-Site Scripting Vulnerabilities

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.