CVE-2019-11446: Malicious File Upload
An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase (and thus .phP is a bypass), and omits .shtml and .phtml.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11446?
CVE-2019-11446 has a high severity rating due to its potential for remote code execution.
How does CVE-2019-11446 affect ATutor?
CVE-2019-11446 allows users with teacher privileges to execute arbitrary commands on the server.
How do I fix CVE-2019-11446?
To fix CVE-2019-11446, upgrade ATutor to a version higher than 2.2.4 where the vulnerability is addressed.
What version of ATutor is affected by CVE-2019-11446?
CVE-2019-11446 affects ATutor version 2.2.4 and earlier.
Can CVE-2019-11446 be exploited through the File Manager?
Yes, CVE-2019-11446 can be exploited through the Upload Files section in the File Manager via upload.php.