ATutor 1.x - print.php?section Remote File Inclusion

ATutor 1.x - print.php?section Remote File Inclusion source: https://www.securityfocus.com/bid/15221/info ATutor is prone to multiple vulnerabilities. These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks. ATuto...

CVE-2005-2955

config.inc.php in ATutor 1.5.1, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which allows authenticated administrators or educators to execute arbitrary code by uploading files with other executable extensions such as .inc, .php4, or others...

CVE-2005-2956

ATutor 1.5.1, and possibly earlier versions, stores temporary chat logs under the web document root with insufficient access control and predictable filenames, which allows remote attackers to obtain user chat conversations via direct requests to those files...

CVE-2005-2956

ATutor 1.5.1, and possibly earlier versions, stores temporary chat logs under the web document root with insufficient access control and predictable filenames, which allows remote attackers to obtain user chat conversations via direct requests to those files...

CVE-2005-2955

ATutor 1.5.1 (and possibly earlier) is affected by CVE-2005-2955 due to an incomplete blacklist in config.inc.php that fails to block dangerous file extensions during upload, allowing authenticated administrators/educators to execute arbitrary code by uploading files with extensions like .inc or ...

CVE-2005-2954

SQL injection vulnerability in passwordreminder.php in ATutor before 1.5.1 pl1 allows remote attackers to execute arbitrary SQL commands via the email field...

CVE-2005-2956

ATutor 1.5.1 (and possibly earlier) stores temporary chat logs under the web document root with insufficient access control and predictable filenames, allowing remote attackers to obtain user chat conversations via direct requests to those files. This CVE entry contains the core detail; no exploi...

CVE-2005-2954

CVE-2005-2954 corresponds to an SQL injection vulnerability in ATutor’s password_reminder.php, exploitable via the email field and affecting ATutor prior to 1.5.1 pl1. The issue is described as an input validation flaw in the remote version of ATutor, enabling attackers to manipulate SQL queries....

CVE-2005-2955

config.inc.php in ATutor 1.5.1, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which allows authenticated administrators or educators to execute arbitrary code by uploading files with other executable extensions such as .inc, .php4, or others...

[SA16813] ATutor Password Reminder SQL Injection Vulnerability

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

atutor-151.txt

ATUTOR 1.5.1 possibly prior versions SQL INJECTION / ADMIN & USERS CREDENTIALS DISCLOSURE / INFORMATION DISCLOSURE / USER IMPERSONATION / REMOTE CODE EXECUTION software: site: http://www.atutor.ca/ description: "ATutor is an Open Source Web-based Learning Content Management System LCMS designed...

ATutor 1.5.1 - 'password_reminder.php' SQL Injection

source: https://www.securityfocus.com/bid/14831/info ATutor is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...

ATutor 1.5.1 SQL Injection / Admin credentials disclosure / remote code execution

ATUTOR 1.5.1 possibly prior versions SQL INJECTION / ADMIN & USERS CREDENTIALS DISCLOSURE / INFORMATION DISCLOSURE / USER IMPERSONATION / REMOTE CODE EXECUTION software: site: http://www.atutor.ca/ description: "ATutor is an Open Source Web-based Learning Content Management System LCMS designed...

ATutor 1.5.1 - password_reminder.php SQL Injection

ATutor 1.5.1 - passwordreminder.php SQL Injection source: https://www.securityfocus.com/bid/14831/info ATutor is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...

ATutor 1.5.1 Multiple Script XSS

The remote host is running ATutor, a CMS written in PHP. The remote version of this software is prone to cross-site scripting attacks due to its failure to sanitize user-supplied input. %NASLMINLEVEL 70300 This script was written by Josh Zlatin-Amishav This script is released under the GNU GPLv2...

CVE-2005-2649

Cross-site scripting XSS vulnerability in ATutor 1.5.1 allows remote attackers to inject arbitrary web script or HTML via 1 course parameter in login.php or 2 words parameter in search.php...

CVE-2005-2649

CVE-2005-2649 describes a cross-site scripting (XSS) vulnerability in ATutor 1.5.1 that allows remote attackers to inject arbitrary script or HTML via the parameters course in login.php or words in search.php. The CVE is cited with a base score of 4.3 (Medium) on the NVD entry, and multiple conne...

CVE-2005-2649

Cross-site scripting XSS vulnerability in ATutor 1.5.1 allows remote attackers to inject arbitrary web script or HTML via 1 course parameter in login.php or 2 words parameter in search.php...

atutor151.txt

ATutor 1.5.1 and prior multiple XSS Vulnerabilities SEVERITY: ========= Medium SOFTWARE: ========= ATutor 1.5.1 http://www.atutor.ca/ INFO: ===== ATutor 1.5.1 is a web based education portal. DESCRIPTION: ============ The system is vulnerable to various XSS attacks: --==XSS==-- Some examples -...

ATutor 1.5.1 - 'login.php?course' Cross-Site Scripting

source: https://www.securityfocus.com/bid/14598/info ATutor is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an...