CVE-2019-12170

ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.

CVSS v3.0

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

8.75% chance of exploitation in the next 30 days, 95th percentile

Published

2019-05-17

Updated

2024-08-04

Proof-of-concept exploits (2)

• fuzzlove/ATutor-Instructor-Backup-Arbitrary-File3★ · 2019-06-03
• fuzzlove/ATutor-2.2.4-Language-Exploit4★ · 2019-06-09

References

• CVE Record
• NVD entry

Related

• CVE-2018-19861
• CVE-2018-19862
• CVE-2019-12169
• CVE-2019-18839
• CVE-2019-18873
• CVE-2024-33722