Description: Some vulnerabilities have been discovered in Dokeos, which can exploited by malicious users to conduct directory traversal attacks.
1) Input passed to the "delete" parameter in /claroline/scorm/scormdocument.php is not properly sanitised before being used to delete directories. This can be exploited via directory traversal attacks to delete arbitrary directories that the web server has permissions to.
2) Input passed to the "move_file" and "move_to" parameters in /claroline/document/document.php is not properly sanitised before being used to move files. This can be exploited via directory traversal attacks to move or copy files that the web server has permissions to.
3) Error messages generated by /claroline/scorm/showinframes.php and /claroline/scorm/contents.php can be used to determine whether or not a specific file exists via directory traversal sequences in the "file" parameter.
Successful exploitation requires that the user is logged on with course administration privileges (e.g. teachers).
The vulnerabilities have been confirmed in version 1.6. Other versions may also be affected.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
