CVE-2014-9753 confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.
CriticalCVSS 9.8
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atutor | <= 2.2 | No fix listed |
References
- karmainsecurity.com exploit third-party-advisory
- seclists.org exploit mailing-list third-party-advisory
- update.atutor.ca broken-link
- www.securityfocus.com broken-link
- github.com patch third-party-advisory