Digital Security Research Group have reported some vulnerabilities in Claroline, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed in the URL to announcements/messages.php, auth/lostPassword.php, auth/profile.php, calendar/myagenda.php, group/group.php, learnPath/learningPath.php, learnPath/learningPathList.php, learnPath/module.php, phpbb/index.php, tracking/courseLog.php, tracking/course_access_details.php, tracking/delete_course_stats.php, tracking/userLog.php, tracking/user_access_details.php, user/user.php, and user/userInfo.php, the "view" parameter in tracking/courseLog.php, and "toolId" in tracking/toolaccess_details.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. All the scripts are located in the "claroline/" directory.

The vulnerabilities are reported in version 1.8.10. Prior versions may also be affected.

Solution
Update to version 1.8.11.

Provided and/or discovered by
Digital Security Research Group

Changelog
Further details available to Secunia VIM customers

Original Advisory
Claroline:
http://sourceforge.net/project/shownotes.php?release_id=615030

Digital Security Research Group:
http://seclists.org/bugtraq/2008/Jul/0199.html

Deep Links
Links available to Secunia VIM customers