Description
ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.
Remediation
References
Related Vulnerabilities
MySQL CVE-2015-2639 Vulnerability (CVE-2015-2639)
Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-3724)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-4288)
WordPress Plugin Article Directory Cross-Site Scripting (1.3)
WordPress Plugin Wonder PDF Embed Cross-Site Scripting (1.6)