CVE-2012-6528
Description
Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 2.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) themes/default/tile_search/index.tmpl.php, (2) login.php, (3) search.php, (4) password_reminder.php, (5) login.php/jscripts/infusion, (6) login.php/mods/_standard/flowplayer, (7) browse.php/jscripts/infusion/framework/fss, (8) registration.php/themes/default/ie_styles.css, (9) about.php, or (10) themes/default/social/basic_profile.tmpl.php.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
ATutor 2.0.3 - Multiple Cross-Site Scripting Vulnerabilities
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| atutor | atutor | {"endIncluding":"2.0"} | |
| atutor | atutor | 1.0 | |
| atutor | atutor | 1.2.1 | |
| atutor | atutor | 1.2.2 | |
| atutor | atutor | 1.3 | |
| atutor | atutor | 1.3.1 | |
| atutor | atutor | 1.3.2 | |
| atutor | atutor | 1.3.3 | |
| atutor | atutor | 1.4 | |
| atutor | atutor | 1.4.1 | |
| atutor | atutor | 1.4.2 | |
| atutor | atutor | 1.4.3 | |
| atutor | atutor | 1.5.1 | |
| atutor | atutor | 1.5.2 | |
| atutor | atutor | 1.5.3 | |
| atutor | atutor | 1.5.3.1 | |
| atutor | atutor | 1.5.3.2 | |
| atutor | atutor | 1.5.4 | |
| atutor | atutor | 1.5.5 | |
| atutor | atutor | 1.6 | |
| atutor | atutor | 1.6.1 | |
| atutor | atutor | 1.6.4 | |
| atutor | atutor | 2.0.1 | |
| atutor | atutor | 2.0.2 | |
| atutor | atutor | 2.0.3 | |
References
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0094.html
- http://atutor.ca/atutor/change_log.php
- http://secunia.com/advisories/47597
- http://www.darksecurity.de/advisories/2012/SSCHADV2012-002.txt
- http://www.securityfocus.com/bid/51423
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72412
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0094.html
- http://atutor.ca/atutor/change_log.php
- http://secunia.com/advisories/47597
- http://www.darksecurity.de/advisories/2012/SSCHADV2012-002.txt
- http://www.securityfocus.com/bid/51423
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72412
CWEs
CWE-79
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.