CVE-2017-1000002

published 2017-07-17

CVE-2017-1000002: ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution…

Priority P2 69 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
atutor	atutor	<= 2.2.1	—

Detection & IOCs extracted from sources · hover to see the quote

path confirm.php↗

path password_reminder.php↗

• → Monitor for ZIP file uploads containing directory traversal sequences (e.g., '../') in file paths within the archive, targeting the ATutor Course component file manager. ↗
• → Alert on authentication bypass attempts against confirm.php using type juggling (loose PHP comparison abuse), which may allow unauthenticated access to restricted ATutor functionality. ↗
• → Alert on suspicious requests to password_reminder.php that may indicate a TOCTOU-based remote password reset attack to hijack accounts without authentication. ↗
• → The exploit chain can be executed with a student-level account; monitor for new student self-registrations followed immediately by file upload or course management activity, as remote registration is enabled by default. ↗
• → Detect file extension blacklist bypass attempts in the ATutor Course component — uploaded archives that pass extension checks but contain executable payloads after extraction indicate exploitation. ↗
• → ATutor directory traversal in the Course Icon component can result in information disclosure; monitor HTTP responses for unexpected file content returned via course icon upload/retrieval endpoints. ↗

• · The directory traversal and RCE exploit specifically requires PHP display_errors to be set to On in the Apache/PHP configuration; environments with display_errors Off may not be exploitable via this exact technique. ↗
• · The module uses two separate authentication bypass vulnerabilities (Type Juggling on confirm.php and TOCTOU on password_reminder.php) only when remote registration is disabled; if remote registration is enabled, a student account suffices. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22