A vulnerability, which was classified as critical, has been found in ATutor (Learning Management Software). This issue affects some unknown processing. The manipulation of the argument type with an unknown input leads to a code injection vulnerability. Using CWE to declare the problem leads to CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

PHP remote file inclusion vulnerability in tools/packages/import.php in ATutor 1.6.1 pl1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via a URL in the type parameter.

The weakness was disclosed 07/30/2008 (Website). It is possible to read the advisory at milw0rm.com. The identification of this vulnerability is CVE-2008-3368 since 07/30/2008. The exploitation is known to be easy. The attack may be initiated remotely. Required for exploitation is a simple authentication. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

A public exploit has been developed by Khashayar Fereidani and been published even before and not after the advisory. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k.

The vulnerability is also documented in the databases at X-Force (44051) and Exploit-DB (6153).

Productinfo

Type

• Learning Management Software

Name

• ATutor

Version

• 0.9.6
• 0.9.7
• 1.0
• 1.2.1
• 1.2.2
• 1.3
• 1.3.1
• 1.3.2
• 1.3.3
• 1.4
• 1.4.1
• 1.4.2
• 1.4.3
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.3.1
• 1.5.3.2
• 1.5.4
• 1.5.5
• 1.6
• 1.6.1

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion