PT-2006-4359 · Atutor · Atutor

Published 2006-07-10 · Updated 2011-03-08 · CVE-2006-3484

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ATutor versions prior to 1.5.3

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved by manipulating various parameters in different scripts, including show courses, current cat, p, forgot, cat, and submit parameters to specific API endpoints such as "/admin/create course.php", "/users/create course.php", "/documentation/admin/", "/password reminder.php", "/users/browse.php", and "/admin/fix content.php".

Recommendations For ATutor versions prior to 1.5.3, update to version 1.5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable parameters show courses, current cat, p, forgot, cat, and submit in the affected scripts until a patch is applied. Avoid using these parameters in the respective API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-3484

Affected Products

Atutor

References · 16

• 🔥 https://exploit-db.com/exploits/28178 · Exploit
• 🔥 http://securityfocus.com/bid/18857 · Exploit
• 🔥 https://exploit-db.com/exploits/28179 · Exploit
• 🔥 https://exploit-db.com/exploits/28177 · Exploit
• 🔥 http://secunia.com/advisories/20941 · Exploit
• 🔥 https://exploit-db.com/exploits/28180 · Exploit
• 🔥 http://atutor.ca/view/3/8341/1.html · Exploit
• 🔥 https://exploit-db.com/exploits/28176 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3484 · Security Note
• http://osvdb.org/27021 · Note
• http://osvdb.org/27023 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3484 · Note
• http://osvdb.org/27019 · Note
• http://osvdb.org/27022 · Note
• http://vupen.com/english/advisories/2006/2691 · Note