CSRF Vulnerability in ATutor Learning Management System
CVE-2016-2539
8.8HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2016-2539?
A cross-site request forgery (CSRF) vulnerability exists in the install_modules.php file of ATutor prior to version 2.2.2. This flaw allows remote attackers to manipulate user sessions, potentially enabling them to upload arbitrary files. If exploited, the vulnerability could permit the execution of arbitrary PHP code remotely, representing a significant security risk for affected ATutor installations. Mitigation involves upgrading to version 2.2.2 or higher, and implementing robust security measures to guard against CSRF attacks.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.