CVE-2017-1000004 - ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Course Enrolment, Group Membership, Course unenrolment, Course Enrolment List Search, Glossary, Social Group Member Search, Social Friend Search, Social Group Search, File Comment, Gradebook Test Title, User Group Membership, Inbox/Sent Items, Sent Messages, Links, Photo Album, Poll, Social Application, Social Profile, Test, Content Menu, Auto-Login, and Gradebook components resulting in information disclosure, database modification, or potential code execution

Back Back to CVE browser

CRITICAL

ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Course Enrolment, Group Membership, Course unenrolment, Course Enrolment List Search, Glossary, Social Group Member Search, Social Friend Search, Social Group Search, File Comment, Gradebook Test Title, User Group Membership, Inbox/Sent Items, Sent Messages, Links, Photo Album, Poll, Social Application, Social Profile, Test, Content Menu, Auto-Login, and Gradebook components resulting in information disclosure, database modification, or potential code execution

Published Jul 13, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 4.73%

Description

ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Course Enrolment, Group Membership, Course unenrolment, Course Enrolment List Search, Glossary, Social Group Member Search, Social Friend Search, Social Group Search, File Comment, Gradebook Test Title, User Group Membership, Inbox/Sent Items, Sent Messages, Links, Photo Album, Poll, Social Application, Social Profile, Test, Content Menu, Auto-Login, and Gradebook components resulting in information disclosure, database modification, or potential code execution.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

http://www.atutor.ca/atutor/mantis/changelog_page.php?version_id=55
x_refsource_CONFIRMVendor Advisory
http://www.atutor.ca/atutor/mantis/view.php?id=5681
x_refsource_CONFIRMPermissions Required
http://www.securityfocus.com/bid/99599
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1342
Advisory

Link	Providers	Tags
http://www.atutor.ca/atutor/mantis/changelog_page.php?version_id=55		x_refsource_CONFIRMVendor Advisory
http://www.atutor.ca/atutor/mantis/view.php?id=5681		x_refsource_CONFIRMPermissions Required
http://www.securityfocus.com/bid/99599		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1342		Advisory