The host is running Claroline and is prone to SQL Injection Vulnerability.

Successful exploitation will allow attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Impact Level: Application

upgrade to the version version 1.8.12 or later For updates refer tohttp://www.claroline.net/download/stable.html

The flaw is due to, - error in 'claroline/linker/notfound.php' which is not properly sanitising input data passed via the 'Referer' header, before being returned to the user. - error in 'group/group.php' which is not properly sanitising input data passed to the 'sort' parameter, before being used in an SQL query.

Claroline Version 1.8.11 and prior

• http://gsasec.blogspot.com/2009/05/claroline-v1811-cross-site-scripting.html
• http://secunia.com/advisories/35019
• http://xforce.iss.net/xforce/xfdb/50404

---

Updated on 2015-03-25