CVE-2013-6787: SQL Injection
SQL injection vulnerability in the checkuserpassword function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0" parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6787?
CVE-2013-6787 is classified as a moderate risk SQL injection vulnerability.
How do I fix CVE-2013-6787?
To fix CVE-2013-6787, you should update Chamilo LMS to a version that implements password encryption or apply patch updates provided by the developers.
Who is affected by CVE-2013-6787?
CVE-2013-6787 affects Chamilo LMS versions 1.9.6 and earlier, as well as several specific earlier versions.
What type of vulnerability is CVE-2013-6787?
CVE-2013-6787 is an SQL injection vulnerability found in the check_user_password function of Chamilo LMS.
Can CVE-2013-6787 be exploited remotely?
Yes, CVE-2013-6787 can be exploited by remote authenticated users who can send crafted SQL commands through the password0 parameter.