CVE-2016-2539
Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file.
- Affected products
- Atutor
- Atutor
- ≤ 2.2.1
- Fix
- Available
- CVSS 3.0
- 8.8 HIGH
- EPSS
- 4.3% (90th percentile)
- Weakness
- CWE-352
- NVD status
- Modified
- Published
- 2017-02-07
CVE-2016-2539 at NVD
5 known exploits for CVE-2016-2539
Proof-of-concept code and exploit modules indexed by Sploitus
ATutor LMS - install_modules.php Cross-Site Request Forgery / Remote Code Execution
ATutor LMS - install_modules.php Cross-Site Request Forgery Remote Code Execution
ATutor LMS - '/install_modules.php' Cross-Site Request Forgery / Remote Code Execution
ATutor LMS 2.2.1 CSRF Remote Code Execution
SRC-2016-0001 : ATutor LMS install_modules CSRF Remote Code Execution Vulnerability