PT-2005-3801 · Atutor · Atutor

Retrogod · Publicado 2005-09-16 · Atualizado 2016-10-18 · CVE-2005-2955

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ATutor versions 1.5.1 and earlier

Description The issue arises from an incomplete blacklist used to check for dangerous file extensions in the config.inc.php file. This allows authenticated administrators or educators to execute arbitrary code by uploading files with executable extensions such as .inc, .php4, or others.

Recommendations For ATutor versions 1.5.1 and earlier, update the blacklist in config.inc.php to include all executable file extensions to prevent the upload of malicious files. As a temporary workaround, consider restricting file uploads to only trusted users or disabling the file upload feature until a comprehensive fix is applied.

Exploit

Correção

Identificadores relacionados

CVE-2005-2955

Produtos afetados

Atutor

Referências · 4

• 🔥 http://rgod.altervista.org/atutor151.html · Exploit
• http://marc.info/?l=bugtraq&m=112671176100432&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2955 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2955 · Nota