Author: Gerendi Sandor Attila
Original Advisory: http://gsasec.blogspot.com/2009/05/claroline-v1811-cross-site-scripting.html
Date: May 05, 2009
Package: Claroline (1.8.11)
Product Homepage: http://www.claroline.net/
Versions Affected: v.1.8.11 (Other versions may also be affected)
Severity: Medium
Input passed to the 'Referer' header parameter when posting to '/claroline/linker/notfound.php' is not sanitized before it is returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Example:
GET /claroline_1_8_11/claroline/linker/notfound.php HTTP/1.0
Accept: */*
Referer: ">