An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged account. The upload section in the file manager page contains an arbitrary file upload vulnerability via upload.php. The extension .php7 bypasses file upload restrictions.
Max CVSS
8.8
EPSS Score
0.11%
Published
2020-03-16
Updated
2020-03-18
user/index_inline_editor_submit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE: this might be due to an incomplete fix for CVE-2012-5168.
Max CVSS
6.5
EPSS Score
0.54%
Published
2012-10-22
Updated
2013-04-11
SQL injection vulnerability in user/index_inline_editor_submit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167.
Max CVSS
6.5
EPSS Score
0.16%
Published
2012-10-22
Updated
2013-04-11
Multiple cross-site scripting (XSS) vulnerabilities in file_manager/preview_top.php in ATutor AContent before 1.2-2 allow remote attackers to inject arbitrary web script or HTML via the (1) pathext, (2) popup, (3) framed, or (4) file parameter.
Max CVSS
4.3
EPSS Score
0.31%
Published
2012-10-22
Updated
2017-08-29
ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to (1) user/index_inline_editor_submit.php or (2) course_category/index_inline_editor_submit.php.
Max CVSS
7.5
EPSS Score
3.20%
Published
2012-10-22
Updated
2017-08-29
Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the (1) field parameter to course_category/index_inline_editor_submit.php or (2) user/index_inline_editor_submit.php; or (3) id parameter to user/user_password.php.
Max CVSS
7.5
EPSS Score
0.72%
Published
2012-10-22
Updated
2017-08-29
6 vulnerabilities found