FKIE_CVE-2006-2284

Vulnerability from fkie_nvd - Published: 2006-05-10 02:14 - Updated: 2025-04-03 01:03
Severity ?
Summary
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) clarolineRepositorySys parameter in ldap.inc.php and the (2) claro_CasLibPath parameter in casProcess.inc.php.
References
cve@mitre.orghttp://secunia.com/advisories/20003Patch, Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/875
cve@mitre.orghttp://www.osvdb.org/25316
cve@mitre.orghttp://www.securityfocus.com/archive/1/433249/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/17873Exploit, Patch
cve@mitre.orghttp://www.vupen.com/english/advisories/2006/1701
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/26280
cve@mitre.orghttps://www.exploit-db.com/exploits/1766
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/20003Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/875
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/25316
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/433249/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/17873Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/1701
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/26280
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/1766
Impacted products
Vendor Product Version
claroline claroline 1.5
claroline claroline 1.5.3
claroline claroline 1.5.4
claroline claroline 1.6
claroline claroline 1.6_beta
claroline claroline 1.6_rc1
claroline claroline 1.7.2
claroline claroline 1.7.4
claroline claroline 1.7.5
dokeos dokeos 1.4
dokeos dokeos 1.5
dokeos dokeos 1.5.3
dokeos dokeos 1.5.4
dokeos dokeos 1.5.5
dokeos dokeos 1.6.4
dokeos dokeos 1.6_rc2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:claroline:claroline:1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "9AE56684-B98B-4642-93F3-8C6297246E78",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:claroline:claroline:1.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "88E5AD48-31AA-4A9E-969A-6E45E4B6F827",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:claroline:claroline:1.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0BD0DDD-51EC-40E6-8E6D-635E449478AF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:claroline:claroline:1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "54EA479E-E55B-45B2-9DD2-4E2D088AF51B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:claroline:claroline:1.6_beta:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3FF8764-0B6C-439B-9333-473F54B9921A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:claroline:claroline:1.6_rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A58F1F26-B87D-4445-AB31-0648A7B32E3F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:claroline:claroline:1.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "24F49508-B7BC-4971-B3A7-279DCE45E369",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:claroline:claroline:1.7.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "2DC9DF44-4883-422F-9FB8-57CDE7EA6C43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:claroline:claroline:1.7.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FD502BE-8878-461D-AA04-AA450F652DC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dokeos:dokeos:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "35B1B18B-F92C-4951-8442-DE11FE355840",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dokeos:dokeos:1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "6329F5E2-97BD-4D5B-A014-4CB3ABFDAB7F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dokeos:dokeos:1.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D280AB8A-6162-47BB-9703-882EF3619B3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dokeos:dokeos:1.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "25C0C6A4-3C86-4464-9D27-16E18CE5ADB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dokeos:dokeos:1.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "85349E3B-08CE-4188-88A5-3515EA26E6F4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dokeos:dokeos:1.6.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "71A3134F-784C-461A-B710-599A2C0A109A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dokeos:dokeos:1.6_rc2:*:*:*:*:*:*:*",
              "matchCriteriaId": "4576DCDD-266F-4984-981E-A83CFFE62021",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) clarolineRepositorySys parameter in ldap.inc.php and the (2) claro_CasLibPath parameter in casProcess.inc.php."
    }
  ],
  "evaluatorSolution": "Successful exploitation requires that \"register_globals\" is enabled.",
  "id": "CVE-2006-2284",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-05-10T02:14:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/20003"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/875"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/25316"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/433249/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/17873"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/1701"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26280"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/1766"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/20003"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/875"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/25316"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/433249/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/17873"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/1701"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26280"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/1766"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.