CVE-2017-1000002

ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in...

CVE-2017-1000004

ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Course Enrolment, Group Membership, Course unenrolment, Course Enrolment List Search, Glossary, Social Group Member Search, Social Friend...

CVE-2017-1000003

ATutor 2.2.1 and earlier is affected by CVE-2017-1000003, an incorrect access control check vulnerability that enables privilege escalation. The issue is reported in multiple components: Social Application, Module, and Alternative Content within ATutor. The provided documents specify the affected...

CVE-2017-1000003

ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application component resulting in privilege escalation. ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Module component...

CVE-2017-1000004

CVE-2017-1000004 affects ATutor versions 2.2.1 and earlier, with a SQL injection vulnerability across multiple components (Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Course Enrolment, Group Membership, Course unenrolment, Course Enrolment List Search, Glossa...

ATutor SQL Injection Vulnerability

ATutor is an open source Web-based learning content management system LCMS developed by the ATutor team. The system includes teaching content management, forums, chat rooms and other modules. An SQL injection vulnerability exists in the include/lib/mysqlconnect.inc.php file in ATutor version 2.2....

CVE-2016-2555

SQL injection vulnerability in include/lib/mysqlconnect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php...

CVE-2016-2555

SQL injection vulnerability in include/lib/mysqlconnect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php...

Sql injection

SQL injection vulnerability in include/lib/mysqlconnect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php...

CVE-2016-2555

ATutor 2.2.1 contains a SQL Injection vulnerability in include/lib/mysql_connect.inc.php. The flaw allows remote attackers to execute arbitrary SQL commands through the searchFriends function in friends.inc.php, as detailed in exploit paths (e.g., Exploit-DB entry 39514) and related Metasploit mo...

CVE-2016-2555

SQL injection vulnerability in include/lib/mysqlconnect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php...

PT-2017-8054 · Atutor · Atutor

Name of the Vulnerable Software and Affected Versions: ATutor version 2.2.1 Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved through the searchFriends function to friends.inc.php. Recommendations: For ATutor version 2.2.1, consider...

CVE-2017-6483

Multiple Cross-Site Scripting XSS issues were discovered in ATutor 2.2.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages langcode in themes//admin/systempreferences/languageedit.tmpl.php. An attacker could execute arbitrary HTML and script...

Cross site scripting

Multiple Cross-Site Scripting XSS issues were discovered in ATutor 2.2.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages langcode in themes//admin/systempreferences/languageedit.tmpl.php. An attacker could execute arbitrary HTML and script...

CVE-2017-6483

Multiple Cross-Site Scripting XSS issues were discovered in ATutor 2.2.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages langcode in themes//admin/systempreferences/languageedit.tmpl.php. An attacker could execute arbitrary HTML and script...

CVE-2017-6483

ATutor 2.2.2 is affected by multiple XSS issues due to insufficient filtration of user-supplied data passed to several pages, notably lang_code handling in themes/*/admin/system_preferences/language_edit.tmpl.php. The vulnerability enables an attacker to execute arbitrary HTML and script code in ...

CVE-2017-6483

Multiple Cross-Site Scripting XSS issues were discovered in ATutor 2.2.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages langcode in themes//admin/systempreferences/languageedit.tmpl.php. An attacker could execute arbitrary HTML and script...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file...

CVE-2016-2539

Cross-site request forgery CSRF vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file...

CVE-2016-2539

Cross-site request forgery CSRF vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file...