====================================================================== Secunia Research 27/10/2005 - ATutor Multiple Vulnerabilities - ====================================================================== Table of Contents Affected Software....................................................1 Severity.............................................................2 Vendor's Description of Software.....................................3 Description of Vulnerabilities.......................................4 Solution.............................................................5 Time Table...........................................................6 Credits..............................................................7 About Secunia........................................................8 Verification.........................................................9 ====================================================================== 1) Affected Software ATutor 1.5.1-pl1 Other versions may also be affected. ====================================================================== 2) Severity Rating: Highly critical Impact: System access, exposure of sensitive information, and cross-site scripting Where: Remote ====================================================================== 3) Vendor's Description of Software ATutor is an Open Source Web-based Learning Content Management System (LCMS) designed with accessibility and adaptability in mind. Product link: http://atutor.ca/ ====================================================================== 4) Description of Vulnerabilities Secunia Research has discovered some vulnerabilities in ATutor, which can be exploited by malicious people to conduct cross-site scripting attacks, disclose sensitive information, and compromise a vulnerable system. 1) Input passed to the "addslashes", "asc", and "desc" parameters in "include/html/forum.inc.php" isn't properly verified, before it is used to create a function call. This can be exploited to call an arbitrary PHP function with an arbitrary parameter (e.g. execute arbitrary shell commands with the "exec" function). Examples: http://[host]/include/html/forum.inc.php? addslashes=[function]&asc=[parameter] http://[host]/include/html/forum.inc.php? addslashes=[function]&desc=[parameter] Successful exploitation requires that "register_globals" is enabled. 2) Input passed to the "section" parameter in "body_header.inc.php" and "print.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources. Examples: http://[host]/documentation/common/body_header.inc.php? section=[file]%00 http://[host]/documentation/common/print.php?section=[file]%00 Successful exploitation requires that "register_globals" is enabled and that "magic_quotes_gpc" is disabled. 3) Input passed to the "_base_href" parameter in "admin/translate.php", the "_base_path" parameter in "include/html/editor_tabs/news.inc.php", and the "p" parameter in "documentation/add_note.php" isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. The vulnerabilities have been confirmed in version 1.5.1-pl1. Other versions may also be affected. ====================================================================== 5) Solution Apply patch. http://atutor.ca/view/3/6158/1.html The fixes will also be included in the upcoming 1.5.2 version. ====================================================================== 6) Time Table 10/10/2005 - Vulnerability discovered. 11/10/2005 - Vendor notified. 27/10/2005 - Vendor releases patch. 27/10/2005 - Public disclosure. ====================================================================== 7) Credits Discovered by Andreas Sandblad, Secunia Research. ====================================================================== 8) About Secunia Secunia collects, validates, assesses, and writes advisories regarding all the latest software vulnerabilities disclosed to the public. These advisories are gathered in a publicly available database at the Secunia website: http://secunia.com/ Secunia offers services to our customers enabling them to receive all relevant vulnerability information to their specific system configuration. Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/secunia_security_advisories/ ====================================================================== 9) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2005-55/advisory/ ======================================================================