Vulnerability Details : CVE-2019-16114
Potential exploit
In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution. This occurs because install/include/header.php does not restrict certain changes (to db_host, db_login, db_password, and content_dir) within install/include/step5.php.
Vulnerability category: Execute code
Products affected by CVE-2019-16114
- cpe:2.3:a:atutor:atutor:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-16114
20.80%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-16114
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2019-16114
-
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-16114
-
https://github.com/MostafaSoliman/Security-Advisories/blob/master/CVE-2019-16114/README.md
Security-Advisories/README.md at master · MostafaSoliman/Security-Advisories · GitHubExploit;Third Party Advisory
-
https://github.com/atutor/ATutor/commits/master
Commits · atutor/ATutor · GitHubPatch
Jump to