ATutor-Instructor-Backup-Arbitrary-File

ATutor-Instructor-Backup-Exploit 漏洞名称: ATutor 2.2.4 '备份' 远程命令执行 CVE-2019-12170 Google Dork: inurl:/ATutor/login.php 日期: 2019年5月13日 漏洞作者: liquidsky Joseph McPeters 厂商主页: https://atutor.github.io/ 软件链接: https://sourceforge.net/projects/atutor/files/latest/download 版本: 2.2.4 版本2.2.4及更早版本似乎受影响 测试环境:...

CVE-2019-12170

ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/core/backups/upload.php aka backup component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PH...

CVE-2019-12170

creationtimestamp| type| source ---|---|--- 2019-05-17 22:51:11+00:00| seen| https://t.me/cvemitreorg/71...

CVE-2019-12170

ATutor 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php backup component, enabling remote code execution when a crafted backup ZIP is uploaded by an attacker with instructor privileges. The issue allows PHP files to be written to the web root and executed on the...

Exploit for Unrestricted Upload of File with Dangerous Type in Atutor

ATutor-Instructor-Backup-Exploit - Exploit Title: ATutor 2.2...