CVE-2008-0850: Dokeos

High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonline.php, (2) tracking_list_coaches_column parameter to main/mySpace/index.php, (3) tutor_name parameter to main/create_course/add_course.php, the (4) Referer HTTP header to index.php, and the (5) X-Fowarded-For HTTP header to main/admin/class_list.php.

Affected products

• Dokeos Dokeos: version 1.8.4 only

Published 2008-02-21. Last modified 2026-06-16.