CVE-2005-3405

EPSS 8.1%

ATutor 1.4.1 through 1.5.1-pl1 allows remote attackers to execute arbitrary PHP functions via a direct request to forum.inc.php with a modified addslashes parameter with either the (1) asc or (2) desc parameters set, possibly due to an eval injection vulnerability.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/26431unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://marc.info/?l=bugtraq&m=113043022821049&w=2 http://secunia.com/advisories/16915/http://secunia.com/secunia_research/2005-55/advisory/http://securityreason.com/securityalert/123 http://securitytracker.com/id?1015165 http://www.osvdb.org/20344 http://www.securityfocus.com/bid/15221 http://www.vupen.com/english/advisories/2005/2228