Secunia

Andrea Fabrizi has discovered some vulnerabilities in Docebo, which can be exploited by malicious users to conduct SQL injection attacks.

1) Input passed via the "word" parameter to doceboLms/index.php (when "modname" is set to "faq", "op" is set to "play", and "mode" is set to "help") is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed via the "word" parameter to doceboLms/index.php (when "modname" is set to "link", "op" is set to "play", and "mode" is set to "keyw") is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

3) Input passed via the "id_certificate" parameter to doceboCore/index.php (when "modname" is set to "meta_certificate" and "op" is set to "elemmetacertificate") is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

4) Input passed via the "id_certificate" parameter to doceboCore/index.php (when "modname" is set to "certificate" and "op" is set to "elemcertificate") is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of vulnerabilities #3 and #4 requires Super Admin rights.

The vulnerabilities are confirmed in version 3.6.0.3. Other versions may also be affected.

Solution
Update to version 3.6.0.4.

Provided and/or discovered by
Andrea Fabrizi

Changelog
Further details available in Customer Area

Original Advisory
http://docebo-org-eng.blogspot.com/2010/05/docebo-3604-released.html

Deep Links
Links available in Customer Area