Vulnerability Description
SQL injection vulnerability in the autoDetectRegion function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Accept-Language HTTP header. NOTE: this can be leveraged to execute arbitrary PHP code using the INTO DUMPFILE command.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Docebo | Docebo | <= 3.5.0.3 |
Related Weaknesses (CWE)
References
- http://osvdb.org/40138
- http://secunia.com/advisories/28378Vendor Advisory
- http://www.docebo.org/doceboCms/bugtracker/18_124/bugdetails/appid_24-bugid_198/PatchVendor Advisory
- http://www.securityfocus.com/bid/27211Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39589
- https://www.exploit-db.com/exploits/4879
- https://www.exploit-db.com/exploits/4891
- http://osvdb.org/40138
- http://secunia.com/advisories/28378Vendor Advisory
- http://www.docebo.org/doceboCms/bugtracker/18_124/bugdetails/appid_24-bugid_198/PatchVendor Advisory
- http://www.securityfocus.com/bid/27211Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39589
- https://www.exploit-db.com/exploits/4879
- https://www.exploit-db.com/exploits/4891
FAQ
What is CVE-2008-7153?
CVE-2008-7153 is a vulnerability with a CVSS score of 7.5 (HIGH). SQL injection vulnerability in the autoDetectRegion function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Accept-Lan...
How severe is CVE-2008-7153?
CVE-2008-7153 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-7153?
Check the references section above for vendor advisories and patch information. Affected products include: Docebo Docebo.