CVE-2012-5168 ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to (1) user/index_inline_editor_submit.php or (2) course_category/index_i...
HighCVSS 7.5
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to (1) user/index_inline_editor_submit.php or (2) course_category/index_inline_editor_submit.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atutor acontent | <= 1.2 | No fix listed |
References
- 20121017 Multiple vulnerabilities in AContent exploit mailing-list
- 86428 vdb-entry
- 51014 third-party-advisory vendor-advisory
- 51034 third-party-advisory vendor-advisory
- update.atutor.ca patch
- 56100 exploit vdb-entry
- acontent-pwd-field-security-bypass(79461) vdb-entry
- acontent-indexinlineeditorsubmit-sec-bypass(79462) vdb-entry
- www.htbridge.com exploit