Full Report
CERT Polska has received a report about 13 vulnerabilities (from CVE-2026-64960 to CVE-2026-64972) found in ATutor software.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in ATutor Learning Management System
## CVE Details
Thirteen vulnerabilities have been identified in the ATutor software (CVE-2026-64960 through CVE-2026-64972).
* **CVE-2026-64960:** Unrestricted File Upload (CWE-434)
* **CVE-2026-64961:** IDOR / Authorization Bypass (CWE-639)
* **CVE-2026-64962:** Cross-Site Request Forgery (CWE-352)
* **CVE-2026-64963:** Path Traversal (CWE-22)
* **CVE-2026-64964:** Predictable Identifiers (CWE-340)
* **CVE-2026-64965:** Missing Authorization (CWE-862)
* **CVE-2026-64966:** Path Traversal (CWE-22)
* **CVE-2026-64967:** Path Traversal (CWE-22)
* **CVE-2026-64968:** Server-Side Request Forgery (CWE-918)
* **CVE-2026-64969:** IDOR / Profile Picture Deletion (CWE-639)
* **CVE-2026-64970:** Stored XSS - Registration (CWE-79)
* **CVE-2026-64971:** Reflected XSS - Restore (CWE-79)
* **CVE-2026-64972:** Reflected XSS - Preview (CWE-79)
**CVSS Score:** Not explicitly provided in the source, but the nature of these flaws (RCE via File Upload, SSRF, and IDOR) indicates **Critical** and **High** severity ratings.
## Affected Systems
* **Products:** ATutor (Learning Management System)
* **Versions:** 2.2.4 (Confirmed); other versions are likely affected.
* **Configurations:** Default installations using profile, registration, and import modules.
## Vulnerability Description
ATutor suffers from a wide array of security flaws due to insufficient input validation and missing authorization checks:
* **Remote Code Execution:** CVE-2026-64960 allows attackers to upload dangerous file types.
* **Data Manipulation:** IDOR flaws (CVE-2026-64961/64969) allow users to delete other users' content (e.g., profile pictures).
* **Information Disclosure/Access:** Path traversal and SSRF (CVE-2026-64968) allow access to local files and internal network services.
* **Session Theft:** Stored and Reflected XSS (CVE-2026-64970/71/72) allow attackers to steal session cookies by injecting malicious scripts into profile fields or URLs.
## Exploitation
* **Status:** Reported via Responsible Disclosure; PoC details are contained within the technical report.
* **Complexity:** Low to Medium.
* **Attack Vector:** Network (Remote).
## Impact
* **Confidentiality:** High (Access to internal files, cloud metadata, and session cookies).
* **Integrity:** High (Ability to delete user content and modify application behavior).
* **Availability:** Medium to High (Potential for RCE leading to full system compromise).
## Remediation
### Patches
* **No Patches Available:** The product is **no longer actively supported** (End-of-Life). Vulnerabilities have not been fixed by the vendor.
### Workarounds
* **Decommissioning:** It is strongly recommended to migrate to a supported Learning Management System (e.g., Moodle, Canvas).
* **Access Control:** If the system must remain online, restrict access to the web interface via VPN or IP allow-listing.
* **WAF:** Implement a Web Application Firewall to filter common XSS, Path Traversal, and SSRF payloads.
## Detection
* **Indicators of Compromise:**
* Unexpected `.php` files in upload directories.
* Unusual internal traffic originating from the ATutor server (SSRF).
* Script tags (`<script>`) appearing in user profile database entries (specifically the "phone" field).
* **Detection methods:** Review web server access logs for directory traversal patterns (`../`) or attempts to access `preview.php` with suspicious `popup` parameters.
## References
* CERT Polska Advisory: [https://cert.pl/en/posts/2026/08/vulnerabilities-in-atutor/](https://cert.pl/en/posts/2026/08/vulnerabilities-in-atutor/)
* CVE Details: [https://www.cve.org/CVERecord?id=CVE-2026-64960](https://www.cve.org/CVERecord?id=CVE-2026-64960)
* CVD Policy: [https://cert.pl/en/cvd/](https://cert.pl/en/cvd/)