PT-2017-17100

Name of the Vulnerable Software and Affected Versions ATutor version 2.2.2 Description Multiple Cross-Site Scripting issues were discovered due to insufficient filtration of user-supplied data. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable...

CVE-2017-6483: Improper Neutralization of Input During Web Page Generation

Multiple Cross-Site Scripting XSS issues were discovered in ATutor 2.2.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages langcode in themes//admin/systempreferences/languageedit.tmpl.php. An attacker could execute arbitrary HTML and script...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file...

CVE-2016-2539

Cross-site request forgery CSRF vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file...

CVE-2016-2539

Cross-site request forgery CSRF vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file...

CVE-2016-2539

ATutor

CVE-2016-2539

Cross-site request forgery CSRF vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file...

CVE-2016-2539: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file...

SRC-2017-0004 : AContent Directory Traversal Information Disclosure and Remote Code Execution Vulnerabilities

Vulnerability Details: These vulnerabilities allow remote attackers to disclose information or execute arbitrary code on vulnerable installations of AContent. Authentication is required to exploit the remote code execution vulnerabilities, however account registration is open by default. The...

ATutor 2.2.2 Cross Site Request Forgery

Exploit Title: ATutor2.2.2 Learning Management System Cross-Site Request Forgery Add New Course Date: 13-11-2016 Software Link: https://github.com/atutor/ATutor/releases/tag/atutor222 Vendor: http://www.atutor.ca/ Exploit Author: Saravana Kumar Contact: https://facebook.com/06saravanakumar...

Atutor Cross-Site Request Forgery Vulnerability

ATutor is an open source Web-based learning content management system LCMS developed by the ATutor team. The system includes teaching content management, forums, chat rooms and other modules. A cross-site request forgery vulnerability exists in the /createcourse.php page in ATutor version 2.2.2,...

ATutor 2.2.2 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: ATutor2.2.2 Learning Management System Cross-Site Request Forgery Add New Course Date: 13-11-2016 Software Link: https://github.com/atutor/ATutor/releases/tag/atutor222 Vendor: http://www.atutor.ca/ Exploit Author: Saravana Kuma...

ATutor 2.2.2 - Cross-Site Request Forgery (Add New Course)

ATutor 2.2.2 - Cross-Site Request Forgery Add New Course Exploit Title: ATutor2.2.2 Learning Management System Cross-Site Request Forgery Add New Course Date: 13-11-2016 Software Link: https://github.com/atutor/ATutor/releases/tag/atutor222 Vendor: http://www.atutor.ca/ Exploit Author: Saravana...

Atutor Arbitrary File Disclosure Vulnerability

ATutor is ATutor team developed a set of open source Web-based learning content management system . An arbitrary file disclosure vulnerability exists in Atutor. When saving data information, due to the "icon" HTTP POST passed to the "/mods/core/courses/users/createcourse.php" script, which fails ...

Atutor 2.2.1 Path Traversal

Advisory ID: HTB23297 Product: Atutor Vendor: Atutor Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Advisory Publication: February 24, 2016 without technical details Vendor Notification: February 24, 2016 Vendor Patch: July 1, 2016 Public Disclosure: August 2, 2016...

ATutor 'ims_import.php' directory traversal vulnerability

ATutor is an open source Web-based learning content management system LCMS developed by the ATutor team. A directory traversal vulnerability exists in ATutor 2.2.1. An attacker can exploit this vulnerability to upload and execute arbitrary code with the help of the directory traversal character...

FreeBSD : atutor -- multiple vulnerabilities (00cb1469-4afc-11e6-97ea-002590263bf5)

ATutor reports : Security Fixes: Added a new layer of security over all php superglobals, fixed several XSS, CSRF, and SQL injection vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

FreeBSD : atutor -- multiple vulnerabilities (ffa8ca79-4afb-11e6-97ea-002590263bf5)

ATutor reports : Security Fixes: A number of minor XSS vulnerabilities discovered in the previous version of ATutor have been corrected. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

atutor -- multiple vulnerabilities

ATutor reports: Security Fixes: Added a new layer of security over all php superglobals, fixed several XSS, CSRF, and SQL injection vulnerabilities...

ATutor has multiple vulnerabilities

ATutor is an open source Web-based learning content management system LCMS developed by the ATutor team. An HTML injection and cross-site scripting vulnerability exists in ATutor, which can be exploited by an attacker to execute arbitrary script code, steal cookie-based authentication or control...