SRC-2017-0004 : AContent Directory Traversal Information Disclosure and Remote Code Execution Vulnerabilities

Vulnerability Details:

These vulnerabilities allow remote attackers to disclose information or execute arbitrary code on vulnerable installations of AContent. Authentication is required to exploit the remote code execution vulnerabilities, however account registration is open by default.

The tool_provider_outcome.php script allows a remote attacker to use a directory traversal in the url parameter to disclose information. The question_import.php, ims_import.php and import_test.php scripts allow a remote attacker to upload a specially crafted zip file containing directory traversals. An attacker could leverage this to execute arbitrary code under the context of the web server.

Affected Vendors:

ATutor

Affected Products:

AContent

Vendor Response:

ATutor has issued two updates to correct these vulnerabilities. More details can be found at:

• https://github.com/atutor/AContent/commit/a6568bc0ff8f454ed666ec8976b8665c6c55bd49
• https://github.com/atutor/AContent/commit/bd6f26c954b2e6891c94447d1930ab17d76dc17c