← back
CVE-2008-0850

CVE-2008-0850

EPSS 2.4%
Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonline.php, (2) tracking_list_coaches_column parameter to main/mySpace/index.php, (3) tutor_name parameter to main/create_course/add_course.php, the (4) Referer HTTP header to index.php, and the (5) X-Fowarded-For HTTP header to main/admin/class_list.php.
Affected products
n/a · n/a
public PoCs found — 4
exploitdbwww.exploit-db.com/exploits/31200unverifiedexploitdbwww.exploit-db.com/exploits/31199unverifiedexploitdbwww.exploit-db.com/exploits/31195unverifiedexploitdbwww.exploit-db.com/exploits/31194unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://projects.dokeos.com/index.php?do=details&task_id=2218http://secunia.com/advisories/28974http://securityreason.com/securityalert/3687http://www.securityfocus.com/archive/1/488314/100/0/threadedhttp://www.securityfocus.com/bid/27792http://www.securitytracker.com/id?1019425http://www.vupen.com/english/advisories/2008/0587