CVE:CVE-2008-0850
CNNVD:CNNVD-200802-374
Dokeos存在多个SQL注入漏洞。远程攻击者可以通过(1) whoisonline.PHP的id参数, (2) main/mySpace/index.PHP的tracking_list_coaches_column参数, (3)main/create_course/add_course.PHP的 tutor_name参数, (4) index.PHP的Referer HTTP标题, 以及 (5) main/admin/class_list.PHP的X-Fowarded-For HTTP标题来执行任意SQL命令。
solution:Upgrade dokeos dokeos to a higher version than 1.8.4,and avoid the version 1.8.4