Summary
This host is running Atutor and is prone to information disclosure, SQL injection, and cross site scripting vulnerabilities.
Impact
Successful exploitation will let attackers to execute arbitrary script code or to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Impact Level: Application
Solution
Upgrade to ATutor version 2.0.3 or later.
For updates refer to http://www.atutor.ca/atutor/
Insight
Multiple flaws are due to an,
- Input passed to the 'lang' parameter in '/documentation/index_list.php' is not properly sanitised before being returned to the user.
- Input passed to the 'p_course', 'name' and 'value' parameters in '/mods/_standard/social/set_prefs.php' scripts is not properly sanitised before being used in SQL queries.
- Input passed via the 'search_friends_HASH' POST parameter, where HASH is the value generated by the 'rand_key' parameter, to the '/mods/_standard/social/index_public.php' script is not properly sanitised before being returned to the user.
Affected
ATutor version 2.0.2
References
