QwikSec

Security Database

CVE

CWE

Training

CVE-2005-2955

Published: Sep 16, 2005

Modified: Aug 7, 2024

PUBLISHED

Description

config.inc.php in ATutor 1.5.1, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which allows authenticated administrators or educators to execute arbitrary code by uploading files with other executable extensions such as .inc, .php4, or others.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

20050914 ATutor 1.5.1 SQL Injection / Admin credentials disclosure / Information disclosure / User impersonation / Remote code execution

mailing-list

x_refsource_BUGTRAQ

http://rgod.altervista.org/atutor151.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.