CVE-2019-16114: Critical severity atutor achecker vulnerability
In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution. This occurs because install/include/header.php does not restrict certain changes (to dbhost, dblogin, dbpassword, and contentdir) within install/include/step5.php.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-16114?
CVE-2019-16114 is a vulnerability in ATutor 2.2.4 that allows an unauthenticated attacker to gain access and achieve remote code execution by manipulating application settings.
How severe is CVE-2019-16114?
CVE-2019-16114 has a severity score of 9.8, making it a critical vulnerability.
How can I fix CVE-2019-16114?
To mitigate CVE-2019-16114, users should update ATutor to a patched version that addresses this vulnerability.