CVE-2012-5453

CVE-2012-5453 details a SQL injection in ATutor AContent 1.2-1 via the field parameter in user/index_inline_editor_submit.php. It is tied to an incomplete fix for CVE-2012-5167 and allows remote authenticated users to execute arbitrary SQL commands. NVD lists a base score of 6.5 (MEDIUM). Connect...

CVE-2012-5167

Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the 1 field parameter to coursecategory/indexinlineeditorsubmit.php or 2 user/indexinlineeditorsubmit.php; or 3 id parameter to user/userpassword.php...

CVE-2012-5454

user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE: this might be due to an incomplete fix for CVE-2012-5168...

CVE-2012-5168

ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to 1 user/indexinlineeditorsubmit.php or 2 coursecategory/indexinlineeditorsubmit.php...

CVE-2012-5454

user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE: this might be due to an incomplete fix for CVE-2012-5168...

CVE-2012-5168

ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to 1 user/indexinlineeditorsubmit.php or 2 coursecategory/indexinlineeditorsubmit.php...

CVE-2012-5169

Multiple cross-site scripting XSS vulnerabilities in filemanager/previewtop.php in ATutor AContent before 1.2-2 allow remote attackers to inject arbitrary web script or HTML via the 1 pathext, 2 popup, 3 framed, or 4 file parameter...

CVE-2012-5169

Multiple cross-site scripting XSS vulnerabilities in filemanager/previewtop.php in ATutor AContent before 1.2-2 allow remote attackers to inject arbitrary web script or HTML via the 1 pathext, 2 popup, 3 framed, or 4 file parameter...

CVE-2012-5167

Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the 1 field parameter to coursecategory/indexinlineeditorsubmit.php or 2 user/indexinlineeditorsubmit.php; or 3 id parameter to user/userpassword.php...

CVE-2012-5453

SQL injection vulnerability in user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167...

CVE-2012-5453

SQL injection vulnerability in user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167...

Multiple vulnerabilities in AContent

Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79...

ATutor 1.2 - Multiple Vulnerabilities

ATutor 1.2 - Multiple Vulnerabilities Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authenticatio...

PT-2012-5817

Name of the Vulnerable Software and Affected Versions ATutor AContent versions prior to 1.2-2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters. The affected...

PT-2012-5979

Name of the Vulnerable Software and Affected Versions ATutor AContent versions 1.2-1 Description The issue is related to improper access restriction in the user/index inline editor submit.php file, allowing remote authenticated users to modify arbitrary user passwords via a crafted request. This...

PT-2012-5816

Name of the Vulnerable Software and Affected Versions ATutor AContent versions prior to 1.2-1 Description The issue allows remote attackers to modify arbitrary user passwords or category names. This can be achieved by sending a direct request to specific API endpoints, such as "user/index inline...

PT-2012-5978

Name of the Vulnerable Software and Affected Versions ATutor AContent versions 1.2-1 Description A SQL injection issue exists, allowing remote authenticated users to execute arbitrary SQL commands via the field parameter in the user/index inline editor submit.php file. This issue is a result of a...

PT-2012-5815

Name of the Vulnerable Software and Affected Versions ATutor AContent versions prior to 1.2-1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the field parameter to "course category/index inline editor submit.php" or "user/index inline...

CVE-2012-5453: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167...

CVE-2012-5167: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the 1 field parameter to coursecategory/indexinlineeditorsubmit.php or 2 user/indexinlineeditorsubmit.php; or 3 id parameter to user/userpassword.php...