ATutor Multiple HTML Injection Vulnerabilities
BID:38656
Info
ATutor Multiple HTML Injection Vulnerabilities
| Bugtraq ID: | 38656 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-0971 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 11 2010 12:00AM |
| Updated: | Apr 13 2015 09:02PM |
| Credit: | ItSecTeam |
| Vulnerable: |
ATutor ATutor 1.6.4 |
| Not Vulnerable: | |
Discussion
ATutor Multiple HTML Injection Vulnerabilities
ATutor is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
Attackers require authenticated access with 'Instructor' privileges in order to exploit these issues.
Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.
These issues affect ATutor 1.6.4; prior versions may also be vulnerable.
ATutor is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
Attackers require authenticated access with 'Instructor' privileges in order to exploit these issues.
Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.
These issues affect ATutor 1.6.4; prior versions may also be vulnerable.
Exploit / POC
ATutor Multiple HTML Injection Vulnerabilities
Attackers can exploit these issues via a browser.
Attackers can exploit these issues via a browser.
Solution / Fix
ATutor Multiple HTML Injection Vulnerabilities
Solution:
The vendor reports that these issues will be resolved in the next major release of ATutor; please contact the vendor for more information.
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
The vendor reports that these issues will be resolved in the next major release of ATutor; please contact the vendor for more information.
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].