high8.8Public exploit code
CVE-2016-2539
Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ATutor LMS - '/install_modules.php' Cross-Site Request Forgery / Remote Code Execution2016-03-07 · webapps · php · Verified
Impact
Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Atutor | Atutor | through 2.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/atutor/ATutor/commit/bfc6c80c6c217c5515172f3cc949e13dfa1a92ac
- https://packetstormsecurity.com/files/136109/ATutor-LMS-2.2.1-CSRF-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/39524/
- https://github.com/atutor/ATutor/commit/bfc6c80c6c217c5515172f3cc949e13dfa1a92ac
- https://packetstormsecurity.com/files/136109/ATutor-LMS-2.2.1-CSRF-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/39524/