CVE-2012-5167

ATutor AContent <1.2 - SQL Injection

Title source: llm

Description

Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the (1) field parameter to course_category/index_inline_editor_submit.php or (2) user/index_inline_editor_submit.php; or (3) id parameter to user/user_password.php.

Exploits (1)

exploitdb WORKING POC

webappsphp

https://www.exploit-db.com/exploits/22160

View Code ZIP pw:eip

References (10)

[Exploit] http://archives.neohapsis.com/archives/bugtraq/2012-10/0095.html

[Vendor Advisory] http://secunia.com/advisories/51014

[Vendor Advisory] http://secunia.com/advisories/51034

[Patch] http://update.atutor.ca/acontent/patch/1_2/

[Exploit] http://www.securityfocus.com/bid/56100

[Exploit] https://www.htbridge.com/advisory/HTB23117

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/79459

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/79460

[Third Party Advisory, VDB Entry] http://osvdb.org/86424

[Third Party Advisory, VDB Entry] http://osvdb.org/86425

Scores

EPSS 0.0132

EPSS Percentile 80.0%

Details

CWE

CWE-89

Status published

Products (1)

atutor/acontent < 1.2

Published Oct 22, 2012

Tracked Since Feb 18, 2026