ATutor Registration.PHP SQL Injection Vulnerability

Bugtraq ID:	15355
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 08 2005 12:00AM
Updated:	Nov 08 2005 12:00AM
Credit:	rgod is credited with the discovery of this vulnerability.
Vulnerable:	ATutor ATutor 1.5.1 pl2
Not Vulnerable:

ATutor Registration.PHP SQL Injection Vulnerability

ATutor is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data. An attacker may also be able to exploit this vulnerability to execute arbitrary commands.

ATutor Registration.PHP SQL Injection Vulnerability

No exploit is required.

The following proof of concept exploit code is available:

• /data/vulnerabilities/exploits/atutor_151pl2_xpl.php

ATutor Registration.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ATutor Registration.PHP SQL Injection Vulnerability

References:

• ATutor Homepage (ATutor)
  
• rgod Website (rgod)