Description

An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase (and thus .phP is a bypass), and omits .shtml and .phtml.

Remediation

References

CVE-2019-11446

Related Vulnerabilities

WordPress Plugin FV Flowplayer Video Player Cross-Site Scripting (7.3.13.727)

WordPress Plugin Easy Testimonials Cross-Site Request Forgery (3.6.1)

WordPress Plugin Woody ad snippets-Insert Header Footer Code, AdSense Ads PHP Code Injection (1.3)

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14550)

Oracle Database Server CVE-2015-4740 Vulnerability (CVE-2015-4740)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-434 CVE-2019-11446