CVE-2006-4844

medium · 5.1

PHP remote file inclusion vulnerability in inc/claro_init_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the extAuthSource[newUser] parameter.

5.1

CVSS

10.4%

EPSS (exploit prob.)

96th

EPSS percentile

2006-09-19

Published

AV:N/AC:H/Au:N/C:P/I:P/A:P

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
claroline	claroline	<= 1.7.7
claroline	claroline	1.2
claroline	claroline	1.3
claroline	claroline	1.4
claroline	claroline	1.5
claroline	claroline	1.5.3
claroline	claroline	1.5.4
claroline	claroline	1.6
claroline	claroline	1.6_beta
claroline	claroline	1.6_rc1
claroline	claroline	1.7
claroline	claroline	1.7.1
claroline	claroline	1.7.2
claroline	claroline	1.7.3
claroline	claroline	1.7.4
claroline	claroline	1.7.5
claroline	claroline	1.7.6
dokeos	open_source_learning_and_knowledge_management_tool	1.4
dokeos	open_source_learning_and_knowledge_management_tool	1.5
dokeos	open_source_learning_and_knowledge_management_tool	1.5.3
dokeos	open_source_learning_and_knowledge_management_tool	1.5.4
dokeos	open_source_learning_and_knowledge_management_tool	1.5.5
dokeos	open_source_learning_and_knowledge_management_tool	1.6.4
dokeos	open_source_learning_and_knowledge_management_tool	1.6.4_p1
dokeos	open_source_learning_and_knowledge_management_tool	1.6.5
dokeos	open_source_learning_and_knowledge_management_tool	1.6_rc2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2006-4844