CVE-2020-37147: ATutor 2.2.4 - 'id' SQL Injection
ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers to manipulate database queries through the 'id' parameter. Attackers can exploit the vulnerability by injecting malicious SQL code into the 'id' parameter of the admindelete.php script to potentially extract or modify database information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-37147?
CVE-2020-37147 has been classified as a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2020-37147?
To fix CVE-2020-37147, ensure that your ATutor installation is updated to the latest version that addresses this SQL injection vulnerability.
Who is affected by CVE-2020-37147?
CVE-2020-37147 affects users of ATutor version 2.2.4 that have the admin user deletion functionality enabled.
What is the impact of CVE-2020-37147?
The impact of CVE-2020-37147 allows authenticated attackers to execute arbitrary SQL commands, which can lead to unauthorized data access or deletion.
How can attackers exploit CVE-2020-37147?
Attackers can exploit CVE-2020-37147 by injecting malicious SQL code into the 'id' parameter on the admin user deletion page.