Description
Multiple SQL injection vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary SQL commands via (1) learningPath.php, (2) learningPathAdmin.php, (3) learnPath_details.php, (4) modules_pool.php, (5) module.php, (6) uInfo parameter in userInfo.php, or (7) exo_id parameter to exercises_details.php.
Remediation
References
Related Vulnerabilities
WordPress Plugin DW Question & Answer Cross-Site Request Forgery (1.5.7)
WebLogic CVE-2019-2398 Vulnerability (CVE-2019-2398)
WordPress Plugin Feedweb Cross-Site Scripting (2.4)
Apache Tomcat Cryptographic Issues Vulnerability (CVE-2011-5064)
Microsoft SQL Server CVE-2024-0056 Vulnerability (CVE-2024-0056)