vendor:
Claroline
by:
rgod
7.5
CVSS
HIGH
Remote Command Execution
CWE
Product Name: Claroline
Affected Version From: Claroline <= 1.7.6
Affected Version To: Claroline <= 1.7.6
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
Claroline <= 1.7.6 "includePath" remote cmmnds xctn
This exploit allows an attacker to execute arbitrary commands on the target system through a remote code inclusion vulnerability in Claroline <= 1.7.6. The vulnerability is due to the insecure handling of user input in the "includePath" parameter, which can be exploited to include arbitrary PHP code from a remote location. By crafting a specially crafted request, an attacker can execute arbitrary commands on the target system.
Mitigation:
To mitigate this vulnerability, it is recommended to update to a newer version of Claroline that includes a fix for this issue. Additionally, it is recommended to ensure that the server is configured securely and to follow best practices for secure coding and input validation.