high7.5Public exploit code
CVE-2005-3404
Multiple PHP file inclusion vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to include arbitrary files via the section parameter follo…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ATutor 1.x - 'print.php?section' Remote File Inclusion2005-10-27 · webapps · php · Verified
- ATutor 1.x - 'body_header.inc.php?section' Local File Inclusion2005-10-27 · webapps · php · Verified
Impact
Multiple PHP file inclusion vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to include arbitrary files via the section parameter followed by a null byte (%00) in (1) body_header.inc.php and (2) print.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Adaptive Technology Resource Centre | Atutor | Versions 1.4.1, 1.4.2, 1.4.3, 1.5.1, 1.5.1_pl1 |
References
- NVD record
- CVE.org record
- http://marc.info/?l=bugtraq&m=113043022821049&w=2
- http://secunia.com/advisories/16915/
- http://secunia.com/secunia_research/2005-55/advisory/
- http://securityreason.com/securityalert/123
- http://securitytracker.com/id?1015165
- http://www.osvdb.org/20345
- http://www.osvdb.org/20346
- http://www.securityfocus.com/bid/15221
- http://www.vupen.com/english/advisories/2005/2228
- http://marc.info/?l=bugtraq&m=113043022821049&w=2
- http://secunia.com/advisories/16915/
- http://secunia.com/secunia_research/2005-55/advisory/
- http://securityreason.com/securityalert/123
- http://securitytracker.com/id?1015165
- http://www.osvdb.org/20345
- http://www.osvdb.org/20346
- http://www.securityfocus.com/bid/15221
- http://www.vupen.com/english/advisories/2005/2228