CVE-2006-4844

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2006-4844
PHP remote file inclusion vulnerability in inc/claro_init_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the extAuthSource[newUser] parameter.

5.1 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://secunia.com/advisories/21931 Exploit Patch Vendor Advisory
http://secunia.com/advisories/21948 Vendor Advisory
http://www.claroline.net/wiki/index.php/Changelog_1.7.x#Modification_between_claroline_1.7.7_and_1.7.8 Patch
http://www.gulftech.org/?node=research&article_id=00112-09142006 Exploit
http://www.gulftech.org/?node=research&article_id=00112-09142006&
http://www.securityfocus.com/bid/20056 Patch
http://www.vupen.com/english/advisories/2006/3638 Vendor Advisory
http://www.vupen.com/english/advisories/2006/3639 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28943
http://secunia.com/advisories/21931 Exploit Patch Vendor Advisory
http://secunia.com/advisories/21948 Vendor Advisory
http://www.claroline.net/wiki/index.php/Changelog_1.7.x#Modification_between_claroline_1.7.7_and_1.7.8 Patch
http://www.gulftech.org/?node=research&article_id=00112-09142006 Exploit
http://www.gulftech.org/?node=research&article_id=00112-09142006&
http://www.securityfocus.com/bid/20056 Patch
http://www.vupen.com/english/advisories/2006/3638 Vendor Advisory
http://www.vupen.com/english/advisories/2006/3639 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28943
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:claroline:claroline:*:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.2:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.3:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.4:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.5:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.5.4:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.6:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.6_beta:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.6_rc1:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.7:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.7.2:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.7.3:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.7.4:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.7.5:*:*:*:*:*:*:*
cpe:2.3:a:claroline:claroline:1.7.6:*:*:*:*:*:*:*
cpe:2.3:a:dokeos:open_source_learning_and_knowledge_management_tool:1.4:*:*:*:*:*:*:*
cpe:2.3:a:dokeos:open_source_learning_and_knowledge_management_tool:1.5:*:*:*:*:*:*:*
cpe:2.3:a:dokeos:open_source_learning_and_knowledge_management_tool:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:dokeos:open_source_learning_and_knowledge_management_tool:1.5.4:*:*:*:*:*:*:*
cpe:2.3:a:dokeos:open_source_learning_and_knowledge_management_tool:1.5.5:*:*:*:*:*:*:*
cpe:2.3:a:dokeos:open_source_learning_and_knowledge_management_tool:1.6.4:*:*:*:*:*:*:*
cpe:2.3:a:dokeos:open_source_learning_and_knowledge_management_tool:1.6.4_p1:*:*:*:*:*:*:*
cpe:2.3:a:dokeos:open_source_learning_and_knowledge_management_tool:1.6.5:*:*:*:*:*:*:*
cpe:2.3:a:dokeos:open_source_learning_and_knowledge_management_tool:1.6_rc2:*:*:*:*:*:*:*
History

21 Nov 2024, 00:16

Type Values Removed Values Added
References () http://secunia.com/advisories/21931 - Exploit, Patch, Vendor Advisory () http://secunia.com/advisories/21931 - Exploit, Patch, Vendor Advisory
References () http://secunia.com/advisories/21948 - Vendor Advisory () http://secunia.com/advisories/21948 - Vendor Advisory
References () http://www.claroline.net/wiki/index.php/Changelog_1.7.x#Modification_between_claroline_1.7.7_and_1.7.8 - Patch () http://www.claroline.net/wiki/index.php/Changelog_1.7.x#Modification_between_claroline_1.7.7_and_1.7.8 - Patch
References () http://www.gulftech.org/?node=research&article_id=00112-09142006 - Exploit () http://www.gulftech.org/?node=research&article_id=00112-09142006 - Exploit
References () http://www.gulftech.org/?node=research&article_id=00112-09142006& - () http://www.gulftech.org/?node=research&article_id=00112-09142006& -
References () http://www.securityfocus.com/bid/20056 - Patch () http://www.securityfocus.com/bid/20056 - Patch
References () http://www.vupen.com/english/advisories/2006/3638 - Vendor Advisory () http://www.vupen.com/english/advisories/2006/3638 - Vendor Advisory
References () http://www.vupen.com/english/advisories/2006/3639 - Vendor Advisory () http://www.vupen.com/english/advisories/2006/3639 - Vendor Advisory
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/28943 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/28943 -
Information

Published : 2006-09-19 01:07

Updated : 2024-11-21 00:16

NVD link : CVE-2006-4844

Mitre link : CVE-2006-4844

CVE.ORG link : CVE-2006-4844

JSON object : View

Products Affected

claroline

  • claroline

dokeos

  • open_source_learning_and_knowledge_management_tool
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')


NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024