CVE-2005-2044
ATutor 1.4.3 and 1.5 RC 1 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 9 public exploits for CVE-2005-2044. PoCs published by Lostmon.
AI-analyzed exploit summary The provided text describes multiple XSS vulnerabilities in ATutor due to improper input sanitization. It includes example URLs demonstrating how arbitrary script code can be executed in a user's browser context.
Description
Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.4.3 and 1.5 RC 1 allow remote attackers to inject arbitrary web script or HTML via the (1) show_course parameter to browse.php, (2) subject parameter to contact.php, (3) cid parameter to content.php, (4) l parameter to inbox/send_message.php, the (5) search, (6) words, (7) include, (8) find_in, (9) display_as, or (10) search parameter to search.php, the (11) submit, (12) query, or (13) field parameter to tile.php, the (14) us parameter to forum/subscribe_forum.php, or the (15) roles[], (16) status, (17) submit, or (18) reset_filter parameters to directory.php.
Exploits (9)
The provided text describes multiple XSS vulnerabilities in ATutor due to improper input sanitization. It includes example URLs demonstrating how arbitrary script code can be executed in a user's browser context.
The provided text describes a cross-site scripting (XSS) vulnerability in ATutor, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code via the 'us' parameter.
The provided text describes a cross-site scripting (XSS) vulnerability in ATutor, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code into the 'l' parameter of the send_message.php page.
This exploit demonstrates multiple XSS vulnerabilities in ATutor by injecting arbitrary script code into various parameters of the search.php page. The PoC provides specific URLs with injection points marked as [XSS-CODE].
This exploit demonstrates multiple XSS vulnerabilities in ATutor by injecting arbitrary script code into the 'roles' and 'status' parameters of the 'directory.php' page. The PoC provides specific URLs with injection points marked as [XSS-CODE].
The provided text describes a cross-site scripting (XSS) vulnerability in ATutor, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code into the 'cid' parameter.
The provided text describes a cross-site scripting (XSS) vulnerability in ATutor, where user-supplied input is not properly sanitized. The example demonstrates how an attacker could inject arbitrary script code via the 'subject' parameter in the contact.php page.
The provided text describes a cross-site scripting (XSS) vulnerability in ATutor, where user-supplied input is not properly sanitized. It includes an example URL demonstrating how arbitrary script code could be executed in the context of the affected site.
The provided text describes a cross-site scripting (XSS) vulnerability in ATutor, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code into the 'view' parameter.