ATutor 2.2.1 SQL Injection / Remote Code Execution
Posted by deepcore on March 2, 2016 – 8:02 pm
This Metasploit module exploits a SQL Injection vulnerability and an authentication weakness vulnerability in ATutor. This essentially means an attacker can bypass authentication and reach the administrators interface where they can upload malicious code. You are required to login to the target to reach the SQL Injection, however this can be done as a student account and remote registration is enabled by default.
Post a reply
You must be logged in to post a comment.