Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0" parameter.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Chamilo LMS ‘password0’参数SQL注入漏洞
Vulnerability Description
Chamilo LMS是Chamilo协会开发的一套开源的在线学习和协作系统。该系统支持创建教学内容、远程培训和在线答题等。 Chamilo LMS 1.9.6及之前的版本中的main/auth/profile.php脚本中的‘check_user_password’函数中存在SQL注入漏洞。当安装程序期间没有加密用户的密码时，远程经过授权的攻击者可借助‘password’HTTP POST参数利用该漏洞执行任意SQL命令。
CVSS Information
N/A
Vulnerability Type
N/A