PT-2005-3801 · Atutor · Atutor

Retrogod · Published 2005-09-16 · Updated 2016-10-18 · CVE-2005-2955

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ATutor versions 1.5.1 and earlier

Description The issue arises from an incomplete blacklist used to check for dangerous file extensions in the config.inc.php file. This allows authenticated administrators or educators to execute arbitrary code by uploading files with executable extensions such as .inc, .php4, or others.

Recommendations For ATutor versions 1.5.1 and earlier, update the blacklist in config.inc.php to include all executable file extensions to prevent the upload of malicious files. As a temporary workaround, consider restricting file uploads to only trusted users or disabling the file upload feature until a comprehensive fix is applied.

Exploit

Fix

Related Identifiers

CVE-2005-2955

Affected Products

Atutor

References · 4

• 🔥 http://rgod.altervista.org/atutor151.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2955 · Security Note
• http://marc.info/?l=bugtraq&m=112671176100432&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2955 · Note