Advertisement






Claroline Open Source e-Learning 1.7.5 Remote File Include

CVE Category Price Severity
CVE-2007-3078 CWE-94 $300 High
Author Risk Exploitation Type Date
GulfTech Security High Remote 2006-05-13
CVSS EPSS EPSSP
CVSS:4.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 0.04279 0.67102

CVSS vector description

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2006050072

Below is a copy:

#############
# Description
#############
# Vendor: http://www.claroline.net
# The file claroline/auth/extauth/drivers/ldap.inc.php uses the variable
# clarolineRepositorySys in a include() function without being declared.
# There are other files vulnerable in the same folder, this exploit only
# attacks ldap.inc.php
#
# There is other vulnerable file claroline/auth/extauth/casProcess.inc.php
# it uses the claro_CasLibPath in a include function but this is not being
# declared either, so pwnt, RFI. Vendor was contacted through email,
# no response, so i just posted this here and on its forum.
############
# Vulnerable code (lda.inc.php)
############
# return require $clarolineRepositorySys.'/auth/extauth/extAuthProcess.inc.php';
############
# Vulnerable code (casProcess.inc.php)
############
#if (   ! isset($_SESSION['init_CasCheckinDone'] )
#    || $logout
#    || ( basename($_SERVER['SCRIPT_NAME']) == 'login.php' &&
isset($_REQUEST['authModeReq']) && $_REQUEST['authModeReq'] == 'CAS' )
#    || isset($_REQUEST['fromCasServer']) )
#{
#    include_once $claro_CasLibPath;
############
# Check www.milw0rm.com for the exploit code.
############
# Greets
# ][GB][ Zetha Wlion desKrriado uyx ASC
############

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.