Locked ATutor 2.2.1 SQL Injection / Remote Code Execution

[dEEpEst]

Credits: mr_me

 

This Metasploit module exploits a SQL Injection vulnerability and an authentication weakness vulnerability in ATutor. This essentially means an attacker can bypass authentication and reach the administrators interface where they can upload malicious code. You are required to login to the target to reach the SQL Injection, however this can be done as a student account and remote registration is enabled by default.

 

[HIDE-THANKS]

This is the hidden content, please

• Sign In
• or
• Sign Up

[/HIDE-THANKS]