BID:27855

ATutor User Profile Multiple HTML Injection Vulnerabilities

Info

ATutor User Profile Multiple HTML Injection Vulnerabilities

Bugtraq ID:	27855
Class:	Input Validation Error
CVE:	CVE-2008-0828
Remote:	Yes
Local:	No
Published:	Feb 18 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	L4teral is credited with discovering these vulnerabilities.
Vulnerable:	ATutor ATutor 1.5.5 ATutor ATutor 1.5.3 2 ATutor ATutor 1.5.3 .1 ATutor ATutor 1.5.3 ATutor ATutor 1.5.1 pl2 ATutor ATutor 1.5.1 pl1 ATutor ATutor 1.5.1 ATutor ATutor 1.4.3 ATutor ATutor 1.4.2 ATutor ATutor 1.4.1 ATutor ATutor 1.5.3 RC2

Not Vulnerable:

Discussion

ATutor User Profile Multiple HTML Injection Vulnerabilities

ATutor is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

ATutor 1.5.5 and prior versions are vulnerable.

Exploit / POC

ATutor User Profile Multiple HTML Injection Vulnerabilities

Attackers can exploit these issues via a browser.

Solution / Fix

ATutor User Profile Multiple HTML Injection Vulnerabilities

Solution:
The vendor released updates to address these issues. Please see the references for more information.

ATutor ATutor 1.5.3 RC2