Docebo Suite is vulnerable to a SQL injection vulnerability in the lib.regset.php/non-blind script. This vulnerability allows an attacker to inject arbitrary SQL commands and gain access to the database. The bug was found by EgiX and works with Mysql >= 4.1 and PHP 5.X. It can be exploited to perform credentials disclosure.
An attacker can inject SQL code through the HTTP Accept-Language header in the query at line 799 of the lib.regset.php file. This can be used to inject PHP code into the Docebo web directory by using the INTO DUMPFILE statement, which requires FILE privilege.
Services By CQR