PT-2019-12675 · Atutor · Atutor

Liquidsky · Published 2019-06-03 · Updated 2024-02-14 · CVE-2019-12169

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ATutor version 2.2.4

Description The issue allows for arbitrary file upload and directory traversal, resulting in remote code execution. This can be achieved by including a ".." pathname in a ZIP archive uploaded to specific components, such as the Import New Language or Patcher component, which are accessed through the mods/ core/languages/language import.php or mods/ standard/patcher/index admin.php endpoints.

Recommendations For ATutor version 2.2.4, consider restricting access to the language import.php and index admin.php files until a patch is available. As a temporary workaround, avoid using the ZIP archive upload feature in the Import New Language and Patcher components to minimize the risk of exploitation.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-12169

Affected Products

Atutor

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atutor_upload_traversal.rb · Exploit
• 🔥 https://github.com/fuzzlove/ATutor-2.2.4-Language-Exploit · Exploit
• 🔥 http://packetstormsecurity.com/files/158246/ATutor-2.2.4-Directory-Traversal-Remote-Code-Execution.html · Exploit
• 🔥 http://incidentsecurity.com/atutor-2-2-4-language_import-arbitrary-file-upload-rce · Exploit
• 🔥 http://packetstormsecurity.com/files/153870/ATutor-2.2.4-Arbitrary-File-Upload-Command-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12169 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12169 · Vendor Advisory
• https://github.com/fuzzlove · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12169 · Note