PT-2019-12311 · Atutorspaces · Atutor

Akkus + 1 · Published 2019-04-22 · Updated 2019-04-26 · CVE-2019-11446

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ATutor versions prior to 2.2.5

Description An issue in ATutor allows a user with teacher privileges to run commands on the server. The File Manager's Upload Files section contains an arbitrary file upload vulnerability via the "upload.php" endpoint. The $IllegalExtensions value is case-sensitive and only lists lowercase extensions, which can be bypassed by using uppercase extensions (e.g., .phP). Additionally, the value omits .shtml and .phtml extensions.

Recommendations For ATutor versions prior to 2.2.5, update to version 2.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Upload Files section in the File Manager to prevent exploitation. Additionally, modify the $IllegalExtensions value to include both lowercase and uppercase extensions, as well as .shtml and .phtml extensions, to prevent bypasses.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-11446

Affected Products

Atutor

References · 5

• 🔥 http://pentest.com.tr/exploits/ATutor-2-2-4-file-manager-Remote-Code-Execution-Injection-Metasploit.html · Exploit
• 🔥 https://exploit-db.com/exploits/46691 · Exploit
• https://osv.dev/vulnerability/CVE-2019-11446 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11446 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11446 · Note