CVE-2019-12169

This repository contains a functional exploit for CVE-2019-12169, which leverages arbitrary file upload and directory traversal in ATutor 2.2.4 to achieve remote code execution. The exploit crafts a malicious ZIP archive with traversal paths to drop a PHP shell in the web root.

This repository contains a functional Python exploit for CVE-2019-12169, which leverages arbitrary file upload and directory traversal in ATutor 2.2.4 to achieve remote code execution. The exploit crafts a malicious ZIP archive with traversal paths to drop a PHP shell in the web root.

This Metasploit module exploits a directory traversal and arbitrary file upload vulnerability in ATutor to achieve remote code execution. It leverages admin credentials to upload a malicious PHP file via 'Import New Language' or 'Patcher' functions, then executes it via HTTP GET request.