Vulnerabilities > CVE-2007-2889 - SQL Injection vulnerability in Dokeos CourseLog.PHP

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

dokeos

exploit available

NVD

Published: 2007-05-30

Updated: 2017-10-11

Summary

SQL injection vulnerability in tracking/courseLog.php in Dokeos 1.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the scormcontopen parameter.

Vulnerable Configurations

Part	Description	Count
Application	Dokeos Dokeos Open Source Learning AND Knowledge Management Tool 1.4 Dokeos Open Source Learning AND Knowledge Management Tool 1.5 Dokeos Open Source Learning AND Knowledge Management Tool 1.5.3 Dokeos Open Source Learning AND Knowledge Management Tool 1.5.4 Dokeos Open Source Learning AND Knowledge Management Tool 1.5.5 Dokeos Open Source Learning AND Knowledge Management Tool 1.6.4 Dokeos Open Source Learning AND Knowledge Management Tool 1.6.4_P1 Dokeos Open Source Learning AND Knowledge Management Tool 1.6.5 Dokeos Open Source Learning AND Knowledge Management Tool 1.6_Rc2	9

Exploit-Db

description	Dokeos <= 1.6.5 (courseLog.php scormcontopen) SQL Injection Exploit. CVE-2007-2889. Webapps exploit for php platform
file	exploits/php/webapps/3980.pl
id	EDB-ID:3980
last seen	2016-01-31
modified	2007-05-24
platform	php
port
published	2007-05-24
reporter	Silentz
source	https://www.exploit-db.com/download/3980/
title	Dokeos <= 1.6.5 courseLog.php scormcontopen SQL Injection Exploit
type	webapps

Summary

Vulnerable Configurations

Exploit-Db

References