EUVD-2015-6461

Malware in sbrugna...

ATutor LMS 2.2.4 Weak Password Reset Hash

Exploit Title: ATutor LMS 2.2.4 - Weak Password Reset Hash Date: 2020-05-05 Exploit Author: Hodorsec Version: 2.2.4 Software Link: https://atutor.github.io/atutor/downloads.html Vendor Homepage: https://atutor.github.io Tested on: Debian 10 x64 - PHP 7.3.15-3 Problem: While the original intention...

ATutor LMS Cross-Site Scripting Vulnerability

ATutor LMS is an open source web-based learning management system LCMS. The system provides course settings, textbook package downloads, multiple reading options, and other features. A cross-site scripting vulnerability exists in ATutor LMS version 2.2. A remote attacker can exploit this...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ATutor LMS version 2.2...

CVE-2015-6521

Multiple cross-site scripting XSS vulnerabilities in ATutor LMS version 2.2...

CVE-2015-6521

ATutor LMS version 2.2 is affected by multiple cross-site scripting (XSS) vulnerabilities. The CNVD entry states a cross-site scripting flaw exists in ATutor LMS 2.2, allowing a remote attacker to inject arbitrary web script or HTML. The NVD entry corroborates XSS in ATutor LMS 2.2 with CVSS v3 b...

SRC-2016-0018 : ATutor LMS view_transcript File Disclosure Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability may allow remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

SRC-2016-0017 : ATutor LMS view_item File Disclosure Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability may allow remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

SRC-2016-0015 : ATutor LMS write_temp_file File Write Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

SRC-2016-0013 : ATutor LMS ims_import Directory Traversal Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

SRC-2016-0011 : ATutor LMS import_test Directory Traversal Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

ATutor LMS - '/install_modules.php' Cross-Site Request Forgery / Remote Code Execution

/ exp.js ATutor LMS " in it - You will need to set the Access-Control-Allow-Origin header to allow the target to pull zips - Use this with your favorite XSS attack - Student proof, aka bullet proof Timeline: 23/02/2016 - notified vendor via infoatatutordotca 24/02/2016 - requested CVE and assigne...

ATutor LMS 2.2.1 CSRF Remote Code Execution

/ exp.js ATutor LMS " in it - You will need to set the Access-Control-Allow-Origin header to allow the target to pull zips - Use this with your favorite XSS attack - Student proof, aka bullet proof Timeline: 23/02/2016 - notified vendor via infoatatutordotca 24/02/2016 - requested CVE and assigne...

ATutor LMS - install_modules.php Cross-Site Request Forgery / Remote Code Execution

Exploit for php platform in category web applications / exp.js ATutor LMS " in it - You will need to set the Access-Control-Allow-Origin header to allow the target to pull zips - Use this with your favorite XSS attack - Student proof, aka bullet proof Timeline: 23/02/2016 - notified vendor via...

ATutor LMS - install_modules.php Cross-Site Request Forgery Remote Code Execution

ATutor LMS - installmodules.php Cross-Site Request Forgery Remote Code Execution / exp.js ATutor LMS " in it - You will need to set the Access-Control-Allow-Origin header to allow the target to pull zips - Use this with your favorite XSS attack - Student proof, aka bullet proof Timeline: 23/02/20...

SRC-2016-0007 : ATutor LMS searchFriends SQL Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the searchFriends function within the ‘friends.inc.php’ script. An attacker...

SRC-2016-0006 : ATutor LMS updateAdditionalInformation SQL Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

SRC-2016-0004 : ATutor LMS SocialGroups search SQL Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

SRC-2016-0012 : ATutor LMS confirm ‘UPDATE’ Type Juggling Authentication Bypass Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to bypass the authentication mechanism on vulnerable installations of ATutor. The specific flaw exists in the ‘confirm.php’ script when updating a members email address. The code uses a loose comparison when comparing the supplied...

SRC-2016-0005 : ATutor LMS searchMembers SQL Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...