ATutor 2.2.1 Directory Traversal / Remote Code Execution

This module exploits a directory traversal vulnerability in ATutor on an Apache/PHP setup with displayerrors set to On, which can be used to allow us to upload a malicious ZIP file. On the web application, a blacklist verification is performed before extraction, however it is not sufficient to...

ATutor 1.5.1 - password_reminder.php SQL Injection

ATutor 1.5.1 - passwordreminder.php SQL Injection source: https://www.securityfocus.com/bid/14831/info ATutor is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...