CVE-2014-9752: Medium severity ATutor ATutor vulnerability
Unrestricted file upload vulnerability in mods/core/properties/lib/course.inc.php in ATutor before 2.2 patch 6 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension as a customicon for a new course, then accessing it via a direct request to the file in content/.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9752?
CVE-2014-9752 is classified as a medium severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2014-9752?
To mitigate CVE-2014-9752, upgrade to ATutor version 2.2 patch 6 or later to secure against the unrestricted file upload issue.
Who is affected by CVE-2014-9752?
CVE-2014-9752 affects authenticated users of ATutor versions prior to 2.2 patch 6 who can upload files as custom icons.
What type of attack does CVE-2014-9752 enable?
CVE-2014-9752 allows an attacker to upload a malicious PHP file, which could lead to remote code execution on the server.
When was CVE-2014-9752 discovered?
CVE-2014-9752 was reported in 2014 and highlights a vulnerability present in earlier versions of ATutor.