Vulnerabilities > CVE-2014-9752 - Unspecified vulnerability in Atutor

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

atutor

NVD

Published: 2015-11-16

Updated: 2018-10-09

Summary

Unrestricted file upload vulnerability in mods/_core/properties/lib/course.inc.php in ATutor before 2.2 patch 6 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension as a customicon for a new course, then accessing it via a direct request to the file in content/. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a>

Vulnerable Configurations

Part	Description	Count
Application	Atutor Atutor Atutor 0.9.6 Atutor Atutor 0.9.7 Atutor Atutor 1.0 Atutor Atutor 1.2.1 Atutor Atutor 1.2.2 Atutor Atutor 1.3 Atutor Atutor 1.3.1 Atutor Atutor 1.3.2 Atutor Atutor 1.3.3 Atutor Atutor 1.4 Atutor Atutor 1.4.1 Atutor Atutor 1.4.2 Atutor Atutor 1.4.3 Atutor Atutor 1.5 Atutor Atutor 1.5.1 Atutor Atutor 1.5.2 Atutor Atutor 1.5.3 Atutor Atutor 1.5.3.1 Atutor Atutor 1.5.3.2 Atutor Atutor 1.5.3.3 Atutor Atutor 1.5.4 Atutor Atutor 1.5.5 Atutor Atutor 1.6 Atutor Atutor 1.6.1 Atutor Atutor 1.6.2 Atutor Atutor 1.6.3 Atutor Atutor 1.6.4 Atutor Atutor 2.0 Atutor Atutor 2.0.1 Atutor Atutor 2.0.2 Atutor Atutor 2.0.3 Atutor Atutor 2.1 Atutor Atutor 2.1.1 Atutor Atutor 2.2	42

Packetstorm

data source	https://packetstormsecurity.com/files/download/134215/KIS-2015-05.txt
id	PACKETSTORM:134215
last seen	2016-12-05
published	2015-11-04
reporter	EgiX
source	https://packetstormsecurity.com/files/134215/ATutor-2.2-File-Upload.html
title	ATutor 2.2 File Upload

Summary

Vulnerable Configurations

Packetstorm

References