medium6.0Public exploit code
CVE-2011-5135
Multiple SQL injection vulnerabilities in the save_connection function in lib/lib.iotask.php in the iotask module in DoceboLMS 4.0.4 and earlier allow remote a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Docebo Lms 4.0.4 - 'Messages' Remote Code Execution2011-12-09 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in the save_connection function in lib/lib.iotask.php in the iotask module in DoceboLMS 4.0.4 and earlier allow remote authenticated users with admin or teacher privileges to execute arbitrary SQL commands via the (1) coursereportuiconfig[name] or (2) coursereportuiconfig[description] parameters to index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Docebo | Docebolms | through 4.0.4 Versions 2.0.4, 2.0.5, 4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.exploit-db.com/exploits/18224
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71720
- https://twitter.com/claudioerba73/status/143383179162685440
- http://www.exploit-db.com/exploits/18224
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71720
- https://twitter.com/claudioerba73/status/143383179162685440