85 matches found
CVE-2012-5453
CVE-2012-5453 details a SQL injection in ATutor AContent 1.2-1 via the field parameter in user/index_inline_editor_submit.php. It is tied to an incomplete fix for CVE-2012-5167 and allows remote authenticated users to execute arbitrary SQL commands. NVD lists a base score of 6.5 (MEDIUM). Connect...
CVE-2012-5167
Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the 1 field parameter to coursecategory/indexinlineeditorsubmit.php or 2 user/indexinlineeditorsubmit.php; or 3 id parameter to user/userpassword.php...
CVE-2012-5454
user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE: this might be due to an incomplete fix for CVE-2012-5168...
CVE-2012-5168
ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to 1 user/indexinlineeditorsubmit.php or 2 coursecategory/indexinlineeditorsubmit.php...
CVE-2012-5454
user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE: this might be due to an incomplete fix for CVE-2012-5168...
CVE-2012-5168
ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to 1 user/indexinlineeditorsubmit.php or 2 coursecategory/indexinlineeditorsubmit.php...
CVE-2012-5169
Multiple cross-site scripting XSS vulnerabilities in filemanager/previewtop.php in ATutor AContent before 1.2-2 allow remote attackers to inject arbitrary web script or HTML via the 1 pathext, 2 popup, 3 framed, or 4 file parameter...
CVE-2012-5169
Multiple cross-site scripting XSS vulnerabilities in filemanager/previewtop.php in ATutor AContent before 1.2-2 allow remote attackers to inject arbitrary web script or HTML via the 1 pathext, 2 popup, 3 framed, or 4 file parameter...
CVE-2012-5167
Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the 1 field parameter to coursecategory/indexinlineeditorsubmit.php or 2 user/indexinlineeditorsubmit.php; or 3 id parameter to user/userpassword.php...
CVE-2012-5453
SQL injection vulnerability in user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167...
CVE-2012-5453
SQL injection vulnerability in user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167...
Multiple vulnerabilities in AContent
Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79...
ATutor 1.2 - Multiple Vulnerabilities
ATutor 1.2 - Multiple Vulnerabilities Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authenticatio...
ATutor 1.2 - Multiple Vulnerabilities
Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79...
PT-2012-5979
Name of the Vulnerable Software and Affected Versions ATutor AContent versions 1.2-1 Description The issue is related to improper access restriction in the user/index inline editor submit.php file, allowing remote authenticated users to modify arbitrary user passwords via a crafted request. This...
PT-2012-5816
Name of the Vulnerable Software and Affected Versions ATutor AContent versions prior to 1.2-1 Description The issue allows remote attackers to modify arbitrary user passwords or category names. This can be achieved by sending a direct request to specific API endpoints, such as "user/index inline...
PT-2012-5978
Name of the Vulnerable Software and Affected Versions ATutor AContent versions 1.2-1 Description A SQL injection issue exists, allowing remote authenticated users to execute arbitrary SQL commands via the field parameter in the user/index inline editor submit.php file. This issue is a result of a...
PT-2012-5815
Name of the Vulnerable Software and Affected Versions ATutor AContent versions prior to 1.2-1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the field parameter to "course category/index inline editor submit.php" or "user/index inline...
CVE-2012-5453: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167...
CVE-2012-5167: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the 1 field parameter to coursecategory/indexinlineeditorsubmit.php or 2 user/indexinlineeditorsubmit.php; or 3 id parameter to user/userpassword.php...