Every CVESearch/Get API key

CVE-2008-0850

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute...

7.5 HighPublic exploit

CVE-2008-0850 is a high vulnerability (CVSS 7.5) in Dokeos, published February 21, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.38%, the 84th percentile. No source names a fixed version.

What does this mean?
Severity
7.5 HighCVSS 2.0, NVD
Exploit chance
2.38%EPSS, 84th percentile
Exploitation
None known4 public exploits
Fixed in
No fix listedNo source names one

Description

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonline.php, (2) tracking_list_coaches_column parameter to main/mySpace/index.php, (3) tutor_name parameter to main/create_course/add_course.php, the (4) Referer HTTP header to index.php, and the (5) X-Fowarded-For HTTP header to main/admin/class_list.php.

Exploit likelihood

2.38%Up 1.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBDokeos 1.8.4 - 'whoisonline.php?id' SQL Injection2008-02-15
Exploit-DBDokeos 1.8.4 - 'main/inc/lib/events.lib.inc.php' Referer HTTP Header SQL Injection2008-02-15
Exploit-DBDokeos 1.8.4 - '/main/mySpace/index.php?tracking_list_coaches_column' SQL Injection2008-02-15
Exploit-DBDokeos 1.8.4 - '/main/create_course/add_course.php?tutor_name' SQL Injection2008-02-15

What each source reports

NVD Score used7.5

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonline.php, (2) tracking_list_coaches_column parameter to main/mySpace/index.php, (3) tutor_name parameter to main/create_course/add_course.php, the (4) Referer HTTP header to index.php, and the (5) X-Fowarded-For HTTP header to main/admin/class_list.php.

Record
CVE-2008-0850
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-89
Updated
2026-11-02
CVE ListNo score

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonline.php, (2) tracking_list_coaches_column parameter to main/mySpace/index.php, (3) tutor_name parameter to main/create_course/add_course.php, the (4) Referer HTTP header to index.php, and the (5) X-Fowarded-For HTTP header to main/admin/class_list.php.

Record
CVE-2008-0850
Updated
2026-11-02
EUVDEUVD-2008-0857No score

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonline.php, (2) tracking_list_coaches_column parameter to main/mySpace/index.php, (3) tutor_name parameter to main/create_course/add_course.php, the (4) Referer HTTP header to index.php, and the (5) X-Fowarded-For HTTP header to main/admin/class_list.php.

Record
EUVD-2008-0857
Updated
2026-11-03
GitHub AdvisoriesGHSA-9c9h-x9w7-3qf7No score

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute...

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonline.php, (2) tracking_list_coaches_column parameter to main/mySpace/index.php, (3) tutor_name parameter to main/create_course/add_course.php, the (4) Referer HTTP header to index.php, and the (5) X-Fowarded-For HTTP header to main/admin/class_list.php.

Record
GHSA-9c9h-x9w7-3qf7
Weakness
CWE-89
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open