Description

PHP remote file inclusion vulnerability in inc/claro_init_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the extAuthSource[newUser] parameter.

Remediation

References

CVE-2006-4844

Related Vulnerabilities

WordPress Plugin WordPress File Upload Arbitrary File Upload (3.8.5)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-2202)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-2427)

OpenSSL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2012-2110)

concrete5 Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-8082)

Severity

Medium

Classification

CVE-2006-4844 CWE-94

Tags

Missing Update Known Vulnerabilities