CVE-2019-12169

ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

73.32% chance of exploitation in the next 30 days, 99th percentile

Published

2019-06-03

Updated

2024-08-04

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/153870/ATutor-2.2.4-Arbitrary-File-Upload-Command-Ex…
• http://packetstormsecurity.com/files/158246/ATutor-2.2.4-Directory-Traversal-Remote-Code-…
• fuzzlove/ATutor-2.2.4-Language-Exploit4★ · 2019-06-09

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atutor_upload_travers…

References

• CVE Record
• NVD entry

Related

• CVE-2018-19861
• CVE-2018-19862
• CVE-2019-12170
• CVE-2019-18839
• CVE-2019-18873
• CVE-2024-33722