Secunia

rgod has reported two vulnerabilities in Claroline, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "includePath" parameter in "claroline/auth/extauth/drivers/mambo.inc.php" and "claroline/auth/extauth/drivers/postnuke.inc.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from external and local resources.

The vulnerability is related to:
SA20003

Successful exploitation requires that "register_globals" is enabled.

The vulnerability has been confirmed in version 1.7.6. Prior versions may also be affected.

Solution
Update to version 1.7.7.
Further details available in Customer Area

Provided and/or discovered by
rgod

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/1877

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area