ID de Prueba:	1.3.6.1.4.1.25623.1.0.126193
Categoría:	Web application abuses
Título:	Forma LMS <= 3.1.0 Multiple Vulnerabilities
Resumen:	Forma LMS is prone to multiple vulnerabilities.
Descripción:	Summary: Forma LMS is prone to multiple vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - CVE-2022-41679: A stored cross-site scripting vulnerability through the back_url parameter in appLms/index.php?modname=faq&op=play function. - CVE-2022-41680: A SQL injection vulnerability through the search[value] parameter in the appLms/ajax.server.php?r=mycertificate/getMyCertificates function. - CVE-2022-41681: Forma LMS could allow an authenticated attacker to privilege escalate in order to upload a Zip file through the SCORM importer feature. - CVE-2022-42923: A SQL injection vulnerability through the id parameter in the appCore/index.php?r=adm/mediagallery/delete function. - CVE-2022-42924: A SQL injection vulnerability through the dyn_filter parameter in the appLms/ajax.adm_server.php?r=widget/userselector/getusertabledata function. - CVE-2022-42925: Forma LMS could allow an authenticated attacker to privilege escalate in order to upload a Zip file through the plugin upload component. Affected Software/OS: Forma LMS version 3.1.0 and prior. Solution: Update to version 3.2.1 or later. CVSS Score: 9.0 CVSS Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2022-41679 https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-forma-lms Common Vulnerability Exposure (CVE) ID: CVE-2022-41680 Common Vulnerability Exposure (CVE) ID: CVE-2022-41681 Common Vulnerability Exposure (CVE) ID: CVE-2022-42923 Common Vulnerability Exposure (CVE) ID: CVE-2022-42924 Common Vulnerability Exposure (CVE) ID: CVE-2022-42925
Copyright	Copyright (C) 2022 Greenbone Networks GmbH

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.