secunia-ATutor.txt

`======================================================================  
  
Secunia Research 27/10/2005  
  
- ATutor Multiple Vulnerabilities -  
  
======================================================================  
Table of Contents  
  
Affected Software....................................................1  
Severity.............................................................2  
Vendor's Description of Software.....................................3  
Description of Vulnerabilities.......................................4  
Solution.............................................................5  
Time Table...........................................................6  
Credits..............................................................7  
About Secunia........................................................8  
Verification.........................................................9  
  
======================================================================  
1) Affected Software  
  
ATutor 1.5.1-pl1  
  
Other versions may also be affected.  
  
======================================================================  
2) Severity  
  
Rating: Highly critical  
Impact: System access, exposure of sensitive information, and  
cross-site scripting  
Where: Remote  
  
======================================================================  
3) Vendor's Description of Software  
  
ATutor is an Open Source Web-based Learning Content Management System   
(LCMS) designed with accessibility and adaptability in mind.  
  
Product link:  
http://atutor.ca/  
  
======================================================================  
4) Description of Vulnerabilities  
  
Secunia Research has discovered some vulnerabilities in ATutor, which   
can be exploited by malicious people to conduct cross-site scripting   
attacks, disclose sensitive information, and compromise a vulnerable   
system.  
  
1) Input passed to the "addslashes", "asc", and "desc" parameters in   
"include/html/forum.inc.php" isn't properly verified, before it is   
used to create a function call. This can be exploited to call an   
arbitrary PHP function with an arbitrary parameter (e.g. execute   
arbitrary shell commands with the "exec" function).  
  
Examples:  
http://[host]/include/html/forum.inc.php?  
addslashes=[function]&asc=[parameter]  
http://[host]/include/html/forum.inc.php?  
addslashes=[function]&desc=[parameter]  
  
Successful exploitation requires that "register_globals" is enabled.  
  
2) Input passed to the "section" parameter in "body_header.inc.php"   
and "print.php" isn't properly verified, before it is used to include   
files. This can be exploited to include arbitrary files from local   
resources.  
  
Examples:  
http://[host]/documentation/common/body_header.inc.php?  
section=[file]%00  
http://[host]/documentation/common/print.php?section=[file]%00  
  
Successful exploitation requires that "register_globals" is enabled   
and that "magic_quotes_gpc" is disabled.  
  
3) Input passed to the "_base_href" parameter in   
"admin/translate.php", the "_base_path" parameter in   
"include/html/editor_tabs/news.inc.php", and the "p" parameter in   
"documentation/add_note.php" isn't properly sanitised before being   
returned to the user. This can be exploited to execute arbitrary   
HTML and script code in a user's browser session in context of an   
affected site.  
  
The vulnerabilities have been confirmed in version 1.5.1-pl1. Other   
versions may also be affected.  
  
======================================================================  
5) Solution  
  
Apply patch.  
http://atutor.ca/view/3/6158/1.html  
  
The fixes will also be included in the upcoming 1.5.2 version.  
  
======================================================================  
6) Time Table  
  
10/10/2005 - Vulnerability discovered.  
11/10/2005 - Vendor notified.  
27/10/2005 - Vendor releases patch.  
27/10/2005 - Public disclosure.  
  
======================================================================  
7) Credits  
  
Discovered by Andreas Sandblad, Secunia Research.  
  
======================================================================  
8) About Secunia  
  
Secunia collects, validates, assesses, and writes advisories regarding  
all the latest software vulnerabilities disclosed to the public. These  
advisories are gathered in a publicly available database at the  
Secunia website:  
  
http://secunia.com/  
  
Secunia offers services to our customers enabling them to receive all  
relevant vulnerability information to their specific system  
configuration.  
  
Secunia offers a FREE mailing list called Secunia Security Advisories:  
  
http://secunia.com/secunia_security_advisories/  
  
======================================================================  
9) Verification  
  
Please verify this advisory by visiting the Secunia website:  
http://secunia.com/secunia_research/2005-55/advisory/  
  
======================================================================  
  
  
  
  
`