CVE-2005-3404

Multiple PHP file inclusion vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to include arbitrary files via the section parameter followed by a null byte %00 in 1 bodyheader.inc.php and 2 print.php...

CVE-2005-3403

Multiple cross-site scripting XSS vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to inject arbitrary web script or HTML via 1 the basehref parameter in translate.php, 2 the basepath parameter in news.inc.php, and 3 the p parameter in addnote.php...

CVE-2005-3403

ATutor

CVE-2005-3404

Multiple PHP file inclusion vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to include arbitrary files via the section parameter followed by a null byte %00 in 1 bodyheader.inc.php and 2 print.php...

CVE-2005-3403

Multiple cross-site scripting XSS vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to inject arbitrary web script or HTML via 1 the basehref parameter in translate.php, 2 the basepath parameter in news.inc.php, and 3 the p parameter in addnote.php...

CVE-2005-3405

ATutor 1.4.1 through 1.5.1-pl1 allows remote attackers to execute arbitrary PHP functions via a direct request to forum.inc.php with a modified addslashes parameter with either the 1 asc or 2 desc parameters set, possibly due to an eval injection vulnerability...

CVE-2005-3405

ATutor

CVE-2005-3404

CVE-2005-3404 : ATutor versions 1.4.1–1.5.1-pl1 are affected by multiple PHP file inclusion vulnerabilities. An attacker can cause remote inclusion of arbitrary files via the section parameter (with a null byte %00) in body_header.inc.php and print.php. This corresponds to an arbitrary file inclu...

secunia-ATutor.txt

====================================================================== Secunia Research 27/10/2005 - ATutor Multiple Vulnerabilities - ====================================================================== Table of Contents Affected Software....................................................1...

ATutor 1.x - forum.inc.php Arbitrary Command Execution

ATutor 1.x - forum.inc.php Arbitrary Command Execution source: https://www.securityfocus.com/bid/15221/info ATutor is prone to multiple vulnerabilities. These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks...

ATutor 1.x - 'body_header.inc.php?section' Local File Inclusion

source: https://www.securityfocus.com/bid/15221/info ATutor is prone to multiple vulnerabilities. These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks. ATutor 1.5.1-pl1 and prior versions are affected...

ATutor 1.x - 'forum.inc.php' Arbitrary Command Execution

source: https://www.securityfocus.com/bid/15221/info ATutor is prone to multiple vulnerabilities. These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks. ATutor 1.5.1-pl1 and prior versions are affected...

ATutor 1.x - 'print.php?section' Remote File Inclusion

source: https://www.securityfocus.com/bid/15221/info ATutor is prone to multiple vulnerabilities. These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks. ATutor 1.5.1-pl1 and prior versions are affected...

ATutor 1.x - body_header.inc.php?section Local File Inclusion

ATutor 1.x - bodyheader.inc.php?section Local File Inclusion source: https://www.securityfocus.com/bid/15221/info ATutor is prone to multiple vulnerabilities. These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attack...

ATutor < 1.5.1-pl1 Multiple Remote Vulnerabilities (XSS, RFI, Command Exe)

The remote host is running ATutor, an open source, web-based Learning Content Management System LCMS written in PHP. The version of ATutor installed on the remote host may be vulnerable to arbitrary command execution, arbitrary file access, and cross-site scripting attacks. Successful exploitatio...

ATutor 1.x - print.php?section Remote File Inclusion

ATutor 1.x - print.php?section Remote File Inclusion source: https://www.securityfocus.com/bid/15221/info ATutor is prone to multiple vulnerabilities. These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks. ATuto...

CVE-2005-2955

config.inc.php in ATutor 1.5.1, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which allows authenticated administrators or educators to execute arbitrary code by uploading files with other executable extensions such as .inc, .php4, or others...

CVE-2005-2956

ATutor 1.5.1, and possibly earlier versions, stores temporary chat logs under the web document root with insufficient access control and predictable filenames, which allows remote attackers to obtain user chat conversations via direct requests to those files...

CVE-2005-2955

ATutor 1.5.1 (and possibly earlier) is affected by CVE-2005-2955 due to an incomplete blacklist in config.inc.php that fails to block dangerous file extensions during upload, allowing authenticated administrators/educators to execute arbitrary code by uploading files with extensions like .inc or ...

CVE-2005-2956

ATutor 1.5.1, and possibly earlier versions, stores temporary chat logs under the web document root with insufficient access control and predictable filenames, which allows remote attackers to obtain user chat conversations via direct requests to those files...