exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Atutor 2.2 Cross Site Scripting

Atutor 2.2 Cross Site Scripting
Posted Feb 3, 2016
Authored by Tim Coen | Site curesec.com

Atutor version 2.2 suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 50ffe9f30ffc04cbef2b00aabb0430927dda4e691a9a92e61ad6aaff6e67387d

Atutor 2.2 Cross Site Scripting

Change Mirror Download
Security Advisory - Curesec Research Team

1. Introduction

Affected Product: Atutor 2.2
Fixed in: partly in ATutor 2.2.1-RC1, complete in 2.2.1
Fixed Version Link: http://www.atutor.ca/atutor/download.php
Vendor Website: http://www.atutor.ca/
Vulnerability Type: XSS
Remote Exploitable: Yes
Reported to vendor: 11/17/2015
Disclosed to public: 02/01/2016
Release mode: Coordinated Release
CVE: n/a
Credits Tim Coen of Curesec GmbH

2. Overview

Atutor is a learning management system (LMS) written in PHP. In version 2.2, it
is vulnerable to multiple reflected and persistent XSS attacks.

The vulnerabilities can lead to the stealing of cookies, injection of
keyloggers, or the bypassing of CSRF protection. If the victim is an admin, a
successful exploitation can lead to code execution via the theme uploader, and
if the victim is an instructor, this can lead to code execution via a file
upload vulnerability in the same version of Atutor.

3. Details

XSS 1: Reflected XSS - Calendar

CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Description: The calendar_next parameter of the calendar is vulnerable to XSS.
This issue has been fixed in ATutor 2.2.1-RC1.

Proof of Concept:

http://localhost/ATutor/mods/_standard/calendar/getlanguage.php?token=calendar_next<script>alert(1)<%2fscript>&pub=1

Code:

/mods/_standard/calendar/getlanguage.php
$token = $_GET['token'];
echo _AT($token);

XSS 2: Persistent XSS - Profile

CVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Description: When saving profile information, < is filtered out. < on the
other hand is not filtered, but converted to <, which leads to persistent XSS.

A user account is needed, but registration is open by default. This issue has
been fixed in ATutor 2.2.1.

Proof of Concept:

Visit:
http://localhost/ATutor/users/profile.php
In any field, enter
<img src=no onerror=alert(1)>

The input is for example echoed when visiting http://localhost/ATutor/users/
profile.php. This self-XSS may be exploited by force-logging in the victim.

The input is not only echoed to the user themselves, but also in other places.

For example, an attacker could send a private message to a victim. When the
victim views the message, or visits their inbox, the injected code will be
executed.

XSS 3: Persistent XSS - Forum

CVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Description: When creating a forum post, the Subject parameter is vulnerable to
persistent XSS.

A user account is needed, but registration is open by default. This issue has
been fixed in ATutor 2.2.1.

Proof of Concept:

Visit a forum, eg here:
http://localhost/ATutor/mods/_standard/forums/forum/view.php?fid=1&pid=1
Post a new message, as Subject, use:
Re: test topic'"><img src=no onerror=alert(1)>

In ATutor 2.2.1-RC1, < and > are encoded, preventing the proof of concept from
working. But until version 2.2.1, it was still possible to exploit this issue
either by using the JavaScript context the input is echoed into (onClick), or
by adding a new attribute:

adding new attributes:
Re: ';" onmouseover="alert(1); var foo='
staying inside the existing JavaScript context:
Re: test topic';alert(1);var foo='

XSS 4: Persistent self-XSS - Calendar

CVSS: Low 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N

Description: The event name of the calendar is vulnerable to persistent XSS.
The calendar seems to be shown only to the user creating it, meaning the only
way to exploit this issue would be to force-login the victim.

A user account is needed, but registration is open by default. This issue has
been fixed in ATutor 2.2.1-RC1.

Proof of Concept:

Visit: http://localhost/ATutor/mods/_standard/calendar/index_mystart.php
Create event with name:
'"><img src=no onerror=alert(1)>
Visit event page: http://localhost/ATutor/mods/_standard/calendar/index_mystart.php

XSS 5: Persistent XSS - Chat

CVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Description: When viewing the chat history, chat messages are not properly HTML
encoded, leading to persistent XSS.

A user account is needed, but registration is open by default. This issue has
been fixed in ATutor 2.2.1-RC1.

Proof of Concept:

1. Visit Chat:
http://localhost/ATutor/mods/_standard/chat/chat.php
2. Enter chat message:
'"><img src=no onerror=alert(1)>
3. Visit chat history of that user:
http://localhost/ATutor/mods/_standard/chat/filterHistory.php?filterChatID=[USERNAME]

4. Solution

To mitigate this issue please upgrade at least to version 2.2.1:

http://www.atutor.ca/atutor/download.php

Please note that a newer version might already be available.

5. Report Timeline

11/17/2015 Informed Vendor about Issue
11/21/2015 Vendor requests more time
01/06/2016 Vendor releases new release candidate with partial fix
01/30/2016 Vendor releases complete fix
02/01/2016 Disclosed to public


Blog Reference:
https://blog.curesec.com/article/blog/Atutor-22-XSS-149.html

--
blog: https://blog.curesec.com
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Romain-Rolland-Str 14-24
13089 Berlin, Germany


Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    25 Files
  • 16
    Aug 16th
    3 Files
  • 17
    Aug 17th
    6 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close