Unscored CVE-2006-6963 EUVD-2006-6946GHSA-rcf3-4fjx-gj97

Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 3.0.3 allow remote attackers to execute arbitrary PHP code via a URL in th…

Published Jan 29, 2007 · Updated Aug 7, 2024 · Assigned by mitre

Description

Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 3.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[where_lms] parameter to (1) class.module/class.definition.php and (2) modules/scorm/scorm_utils.php. NOTE: this issue may overlap CVE-2006-2577.

References

26713 vdb-entry
docebo-multiple-file-include(26633) vdb-entry
20060609 Docebo Lms 3.0.3, Remote command execution mailing-list
http://www.docebo.org/doceboCms/bugtracker/18_124/bugdetails/appid_1-bugid_154/bugtracker.html
2188 third-party-advisory
26712 vdb-entry