CVE-2026-64972 in Atutor
Summary
by MITRE • 08/20/2026
ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The related preview_top.php file sanitises these parameters, but that does not prevent XSS in the parent frameset rendered by preview.php itself.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in ATutor represents a classic reflected cross-site scripting flaw located within the preview.php script, specifically targeting the popup parameter used for rendering content previews. This security issue arises from insufficient input validation and output encoding mechanisms when processing user-supplied data that is immediately reflected back into the HTML response without adequate sanitization. Although the application employs a secondary file named preview_top.php to attempt sanitization of these parameters, this protective measure proves ineffective because it fails to account for the context in which the parent frameset rendered by preview.php operates. The architectural design allows an attacker to bypass the intended security controls by manipulating the parameter structure to escape the current attribute scope and inject malicious scripts directly into the browser's execution environment.
From a technical perspective, the exploitation vector relies on breaking out of existing HTML attributes using double quote characters. Once this boundary is breached, the attacker can append new event handlers such as onload or onclick to execute arbitrary JavaScript code within the victim's browser session. This technique leverages the lack of context-aware encoding in the parent frame rendering logic. The vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Furthermore, this attack aligns with MITRE ATT&CK techniques related to Client-side Injection and Stored XSS if persistent storage were involved, though in this reflected case it falls squarely under client-side script injection via URL parameter manipulation. The presence of framesets exacerbates the risk because scripts executed within one frame can potentially interact with others depending on same-origin policy configurations, increasing the potential impact scope beyond simple alert boxes to more sophisticated session hijacking or credential theft scenarios.
The operational impact of this vulnerability is significant for any deployment running unpatched versions of ATutor. Since an authenticated attacker can exploit this flaw, it implies that compromised user accounts with access to preview functionalities could be leveraged to launch attacks against other users within the same system if they view maliciously crafted links or content generated by the vulnerable script. This facilitates session hijacking, defacement, phishing campaigns disguised as legitimate application interactions, and potential data exfiltration from sensitive areas of the learning management system. The fact that only version 2.2.4 was tested confirms vulnerability does not guarantee safety for other versions; legacy systems often retain similar architectural flaws due to shared codebases or outdated frameworks lacking modern security defaults.
Given that ATutor is no longer actively supported and these vulnerabilities remain unfixed, mitigation strategies must focus on compensating controls rather than software updates. Organizations should implement strict input validation at the network perimeter using Web Application Firewalls configured to detect and block XSS payloads involving event handlers like onload or onclick within URL parameters. Additionally, deploying Content Security Policy headers can restrict script execution sources and mitigate the impact of successful injections by preventing inline scripts from running unless explicitly allowed through nonces or hashes. Access controls should be reviewed to ensure that only necessary roles have access to preview functionalities, reducing the attack surface for authenticated users. Where possible, migrating to a supported alternative platform is strongly recommended to eliminate reliance on legacy code with known unpatched security defects and to benefit from modern security practices including automated testing and regular dependency updates.