Description
Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute arbitrary code via the includePath parameter to learnPath/include/scormExport.inc.php.
References
- http://retrogod.altervista.org/claroline_174_incl_xpl.html
- 19461 third-party-advisory
- 17343 vdb-entry
- ADV-2006-1187 vdb-entry
- claroline-rqmkhtml-directory-traversal(25561) vdb-entry
- 1627 exploit