CVE-2014-9752

First published: Mon Nov 16 2015(Updated: )

Unrestricted file upload vulnerability in mods/_core/properties/lib/course.inc.php in ATutor before 2.2 patch 6 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension as a customicon for a new course, then accessing it via a direct request to the file in content/.

Credit: cve@mitre.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-index
• agent/severity
• agent/references
• agent/author
• agent/tags
• agent/description
• agent/type
• agent/event
• agent/softwarecombine
• agent/first-publish-date
• agent/last-modified-date
• vendor/atutor
• canonical/atutor atutor
• version/atutor atutor/2.2