Vulnerability Details CVE-2005-3405
ATutor 1.4.1 through 1.5.1-pl1 allows remote attackers to execute arbitrary PHP functions via a direct request to forum.inc.php with a modified addslashes parameter with either the (1) asc or (2) desc parameters set, possibly due to an eval injection vulnerability.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.119
EPSS Ranking 93.4%
CVSS Severity
CVSS v2 Score 7.5
References
- http://marc.info/?l=bugtraq&m=113043022821049&w=2
- http://secunia.com/advisories/16915/
- http://secunia.com/secunia_research/2005-55/advisory/
- http://securityreason.com/securityalert/123
- http://securitytracker.com/id?1015165
- http://www.osvdb.org/20344
- http://www.securityfocus.com/bid/15221
- http://www.vupen.com/english/advisories/2005/2228
- http://marc.info/?l=bugtraq&m=113043022821049&w=2
- http://secunia.com/advisories/16915/
- http://secunia.com/secunia_research/2005-55/advisory/
- http://securityreason.com/securityalert/123
- http://securitytracker.com/id?1015165
- http://www.osvdb.org/20344
- http://www.securityfocus.com/bid/15221
- http://www.vupen.com/english/advisories/2005/2228
Products affected by CVE-2005-3405
-
cpe:2.3:a:adaptive_technology_resource_centre:atutor:1.4.1
-
cpe:2.3:a:adaptive_technology_resource_centre:atutor:1.4.2
-
cpe:2.3:a:adaptive_technology_resource_centre:atutor:1.4.3
-
cpe:2.3:a:adaptive_technology_resource_centre:atutor:1.5.1
-
cpe:2.3:a:adaptive_technology_resource_centre:atutor:1.5.1_pl1