CVE-2006-3484

EPSS 2.6%

Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) show_courses or (2) current_cat parameters to (a) admin/create_course.php, show_courses parameter to (b) users/create_course.php, (3) p parameter to (c) documentation/admin/, (4) forgot parameter to (d) password_reminder.php, (5) cat parameter to (e) users/browse.php, or the (6) submit parameter to admin/fix_content.php.

Affected products

n/a · n/a

public PoCs found — 5

exploitdbwww.exploit-db.com/exploits/28180unverified exploitdbwww.exploit-db.com/exploits/28177unverified exploitdbwww.exploit-db.com/exploits/28179unverified exploitdbwww.exploit-db.com/exploits/28176unverified exploitdbwww.exploit-db.com/exploits/28178unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://secunia.com/advisories/20941 http://www.atutor.ca/view/3/8341/1.html http://www.osvdb.org/27019 http://www.osvdb.org/27020 http://www.osvdb.org/27021 http://www.osvdb.org/27022 http://www.osvdb.org/27023 http://www.securityfocus.com/bid/18857 http://www.vupen.com/english/advisories/2006/2691