CVE-2019-12169 PoC — ATutor 路径遍历漏洞

Source

https://github.com/fuzzlove/ATutor-2.2.4-Language-Exploit

Associated Vulnerability

Title:ATutor 路径遍历漏洞 (CVE-2019-12169)
Description:ATutor是Atutor团队的一套开源的基于Web的学习内容管理系统（LCMS）。该系统包括教学内容管理、论坛、聊天室等模块。 ATutor 2.2.4版本中存在路径遍历漏洞。攻击者可利用该漏洞执行代码。

Description

ATutor 2.2.4 Arbitrary File Upload / RCE (CVE-2019-12169)

Readme

# ATutor 2.2.4 Arbitrary File Upload / RCE (CVE-2019-12169)

- Exploit Title: ATutor 2.2.4 Arbitrary File Upload / RCE [CVE-2019-12169]
- Date: 5/24/19
- Exploit Author: liquidsky (JMcPeters)
- Vendor Homepage: https://atutor.github.io/
- Software Link: https://sourceforge.net/projects/atutor/files/latest/download
- Version: 2.2.4
- Tested on: Windows 8 / Apache / MySQL (XAMPP)
- CVE : CVE-2019-12169 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12169
- Author Site: http://incidentsecurity.com | https://github.com/fuzzlove

 Description: ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal
 resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component.

 Greetz: wetw0rk, offsec ^^

 Notes: This application is no longer being maintained so there is no fix for this issue.

 update: if you wish to test this manually I have included the poc.zip for a better understanding.


 -   CVE-2019-12170: https://github.com/fuzzlove/ATutor-Instructor-Backup-Arbitrary-File
 -   CVE-2019-12169: https://github.com/fuzzlove/ATutor-2.2.4-Language-Exploit

File Snapshot


 [4.0K]  /data/pocs/1d9ee396f9e67cb9fef49898b83ba6c42190a5ba
├── [8.0K]  atutor-upload-rce.py
├── [ 562]  poc.zip
└── [1.2K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!