CVE-2012-5167

Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the 1 field parameter to coursecategory/indexinlineeditorsubmit.php or 2 user/indexinlineeditorsubmit.php; or 3 id parameter to user/userpassword.php...

CVE-2012-5168

CVE-2012-5168 affects ATutor AContent prior to 1.2-1. It enables remote attackers to modify arbitrary user passwords or category names by sending crafted requests to (1) user/index_inline_editor_submit.php or (2) course_category/index_inline_editor_submit.php. The vulnerability arises from insuff...

CVE-2012-5169

Multiple cross-site scripting XSS vulnerabilities in filemanager/previewtop.php in ATutor AContent before 1.2-2 allow remote attackers to inject arbitrary web script or HTML via the 1 pathext, 2 popup, 3 framed, or 4 file parameter...

CVE-2012-5454

user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE: this might be due to an incomplete fix for CVE-2012-5168...

Multiple vulnerabilities in AContent

Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79...

CVE-2012-5167: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the 1 field parameter to coursecategory/indexinlineeditorsubmit.php or 2 user/indexinlineeditorsubmit.php; or 3 id parameter to user/userpassword.php...

ATutor 1.2 - Multiple Vulnerabilities

ATutor 1.2 - Multiple Vulnerabilities Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authenticatio...

CVE-2012-5453: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167...

CVE-2012-5168: Undefined Security Weakness

ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to 1 user/indexinlineeditorsubmit.php or 2 coursecategory/indexinlineeditorsubmit.php...

ATutor 1.2 - Multiple Vulnerabilities

Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79...

CVE-2012-5169: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in filemanager/previewtop.php in ATutor AContent before 1.2-2 allow remote attackers to inject arbitrary web script or HTML via the 1 pathext, 2 popup, 3 framed, or 4 file parameter...

CVE-2012-5454: Undefined Security Weakness

user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE: this might be due to an incomplete fix for CVE-2012-5168...

ATutor 1.2 Multiple Vulnerabilities

SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79 CVE References: CVE-2012-5167, CVE-2012-5168, CVE-2012-5169 CVSSv2 Base Scores: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P, 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P, 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Product: AContent Vendor: ATutor...

ATutor AContent 1.2 XSS / Authentication / SQL Injection

Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79...

Multiple vulnerabilities in AContent

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in AContent, which can be exploited to bypass authentication and to perform Cross-Site Scripting XSS and SQL Injection attacks. 1 SQL Injection in AContent: CVE-2012-5167 1.1 The vulnerability exists due to insufficient...

Atutor AContent Multiple SQL Injection and XSS Vulnerabilities

This host is running Atutor AContent and is prone to multiple cross site scripting and SQL injection vulnerabilities. OpenVAS Vulnerability Test $Id: gbatutoracontentmultsqlinjnxssvuln.nasl 7015 2017-08-28 11:51:24Z teissa $ Atutor AContent Multiple SQL Injection and XSS Vulnerabilities Authors:...

Atutor AContent Multiple SQL Injection and XSS Vulnerabilities

Atutor AContent is prone to multiple cross site scripting and SQL injection vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

ATutor AContent 1.1 / 1.3 Cross Site Scripting

AContent 1.1 Multiple Cross-Site Scripting Vulnerabilities Vendor: ATutor Inclusive Design Institute Product web page: http://www.atutor.ca Affected version: 1.1 build r296 Summary: AContent is an open source learning content authoring system and respository used to create interoperable,...

AContent 1.1 Multiple Vulnerabilities

Exploit for php platform in category web applications Vendor: ATutor Inclusive Design Institute Product web page: http://www.atutor.ca Affected version: 1.1 build r296 Summary: AContent is an open source learning content authoring system and respository used to create interoperable, accessible,...

AContent 1.1 (category_name) Remote Script Insertion Vulnerability

Summary AContent is an open source learning content authoring system and respository used to create interoperable, accessible, adaptive Web-based learning content. It can be used along with learning management systems to develop, share, and archive learning materials. Description AContent suffers...