ATutor 2.2 - Multiple Cross-Site Scripting Vulnerabilities

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Atutor 2.2 Fixed in: partly in ATutor 2.2.1-RC1, complete in 2.2.1 Fixed Version Link: http://www.atutor.ca/atutor/download.php Vendor Website: http://www.atutor.ca/ Vulnerability Type: XSS Remote Exploitable: Yes Reporte...

Atutor 2.2 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Atutor 2.2 Fixed in: partly in ATutor 2.2.1-RC1, complete in 2.2.1 Fixed Version Link: http://www.atutor.ca/atutor/download.php Vendor Website: http://www.atutor.ca/ Vulnerability Type: XSS Remote Exploitable: Yes Reporte...

atutor -- multiple vulnerabilities

ATutor reports: Security Fixes: A number of minor XSS vulnerabilities discovered in the previous version of ATutor have been corrected...

AContent 1.3 File Upload

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : http://0day.today 0 1 + Support e-mail :...

ATutor PHP代码注入漏洞

No description provided by source...

ATutor任意文件上传漏洞

No description provided by source...

ATutor PHP Code Injection Vulnerability

ATutor is an open source Web-based learning content management system LCMS developed by the ATutor team. The system includes teaching content management, forums, chat rooms and other modules. An eval injection vulnerability exists in the mods/standard/gradebook/editmarks.php script in ATutor 2.2...

CVE-2015-7712

Multiple eval injection vulnerabilities in mods/standard/gradebook/editmarks.php in ATutor 2.2 and earlier allow remote authenticated users with the ATPRIVGRADEBOOK privilege to execute arbitrary PHP code via the 1 asc or 2 desc parameter...

CVE-2014-9752

Unrestricted file upload vulnerability in mods/core/properties/lib/course.inc.php in ATutor before 2.2 patch 6 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension as a customicon for a new course, then accessing it via a direct request to the...

Unrestricted file upload

Unrestricted file upload vulnerability in mods/core/properties/lib/course.inc.php in ATutor before 2.2 patch 6 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension as a customicon for a new course, then accessing it via a direct request to the...

Sql injection

Multiple eval injection vulnerabilities in mods/standard/gradebook/editmarks.php in ATutor 2.2 and earlier allow remote authenticated users with the ATPRIVGRADEBOOK privilege to execute arbitrary PHP code via the 1 asc or 2 desc parameter...

CVE-2015-7712

Multiple eval injection vulnerabilities in mods/standard/gradebook/editmarks.php in ATutor 2.2 and earlier allow remote authenticated users with the ATPRIVGRADEBOOK privilege to execute arbitrary PHP code via the 1 asc or 2 desc parameter...

CVE-2015-7712

ATutor 2.2 and earlier contains a PHP code injection vulnerability in mods/_standard/gradebook/edit_marks.php that allows remote authenticated users with AT_PRIV_GRADEBOOK privilege to execute arbitrary PHP code via the asc or desc parameters. This is a classic eval/ injection flaw in the gradebo...

CVE-2014-9752

CVE-2014-9752 : ATutor before 2.2 patch 6 suffers an unrestricted file upload via the customicon field in mods/_core/properties/lib/course.inc.php. A remote authenticated user can upload a PHP file to /content/ and access it directly to execute code, requiring at least an account with permission ...

ATutor 2.2 File Upload Vulnerability

ATutor versions 2.2 and below suffer from a remote unrestricted file upload vulnerability. ------------------------------------------------------------------------- ATutor = 2.2 Custom Course Icon Unrestricted File Upload Vulnerability...

ATutor 2.2 Cross Site Scripting Vulnerability

ATutor versions 2.2 and below suffer from a cross site scripting vulnerability. -------------------------------------------------------------------------- ATutor printHelps$h; User input passed through the "h" GET parameter is not properly sanitized before being passed to the "Message::printHelps...

ATutor 2.2 PHP Code Injection Vulnerability

ATutor versions 2.2 and below suffer from a remote php code injection vulnerability. --------------------------------------------------------------- ATutor "name" 186. 187. $sort = '$grades'.$ordercol.', SORT'.strtoupper$order.', $selectedstudents ... 188. 189. foreach$selectedtests as $test 190...

ATutor 2.2 Session Variable Overloading Vulnerability

ATutor versions 2.2 and below suffer from a session variable overloading vulnerability. ---------------------------------------------------------------------- ATutor = 2.2 confirm.php Session Variable Overloading Vulnerability ----------------------------------------------------------------------...

ATutor 2.2 Cross Site Scripting

-------------------------------------------------------------------------- ATutor printHelps$h; User input passed through the "h" GET parameter is not properly sanitized before being passed to the "Message::printHelps" method at line 30. This can be exploited to carry out reflected Cross-Site...

ATutor 2.2 File Upload

------------------------------------------------------------------------- ATutor = 2.2 Custom Course Icon Unrestricted File Upload Vulnerability ------------------------------------------------------------------------- - Software Link: http://www.atutor.ca/ - Affected Versions: Version 2.2 and...