Deepfear

Name of the Vulnerable Software and Affected Versions: Claroline versions 1.5.3 through 1.6 Release Candidate 1 Description: The issue allows remote attackers to inject arbitrary web script or HTML via several API endpoints, including "exercise result.php", "exercice submit.php", "agenda.php", "learningPathList.php", "learningPathAdmin.php", "learningPath.php", "userLog.php", the `tool` parameter to "toolaccess details.php", the `data` parameter to "user access details.php", or the `coursePath` parameter to "myagenda.php". Recommendations: For Claroline versions 1.5.3 through 1.6 Release Candidate 1, consider disabling access to the vulnerable API endpoints until a patch is available. Restrict input for the `tool` parameter to "toolaccess details.php", the `data` parameter to "user access details.php", and the `coursePath` parameter to "myagenda.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Claroline versions 1.5.3 through 1.6 Release Candidate 1 Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several endpoints and parameters, including "learningPath.php", "learningPathAdmin.php", "learnPath details.php", "modules pool.php", "module.php", the `uInfo` parameter in "userInfo.php", or the `exo id` parameter to "exercises details.php". Recommendations: For Claroline versions 1.5.3 through 1.6 Release Candidate 1, consider restricting access to the mentioned endpoints and parameters until a patch is available. As a temporary workaround, avoid using the `uInfo` parameter in "userInfo.php" and the `exo id` parameter in "exercises details.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Claroline versions 1.5.3 through 1.6 Release Candidate 1 Description: The issue concerns directory traversal vulnerabilities in certain PHP files, specifically `document.php` and `insertMyDoc.php`, which could allow remote project administrators to upload arbitrary files. Recommendations: For Claroline versions 1.5.3 through 1.6 Release Candidate 1, consider restricting access to the `document.php` and `insertMyDoc.php` files until a patch is available. As a temporary workaround, limit the ability of remote project administrators to upload files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Claroline versions 1.5.3 through 1.6 Release Candidate 1 Description: The issue allows remote attackers to execute arbitrary PHP code. The estimated number of potentially affected devices and details about real-world incidents are not specified. Recommendations: For Claroline versions 1.5.3 through 1.6 Release Candidate 1, at the moment, there is no information about a newer version that contains a fix for this issue.