# Exploit Title: ATutor_2.2.2 Learning Management System # Cross-Site Request Forgery (Add New Course) # Date: 13-11-2016 # Software Link: https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2 # Vendor: http://www.atutor.ca/ # Exploit Author: Saravana Kumar # Contact: https://facebook.com/06saravanakumar # Category: webapps # Version: 2.2.2 # Platform: PHP # Tested on: [Kali Linux 2.0 | Windows 7] # Email: 06saravanakumar@gmail.com # Affected URL: http://localhost/ATutor/mods/_core/courses/users/create_course.php ================================== Vulnerability Disclosure Timeline:a"==================================a"2016-11-07: Found the vulnerability and Reported to Vendor.a"2016-11-08: Vendor Replied.a"2016-11-10: Vendor Fixed the vulnerability.a"2016-11-11: Patch releaseda"2016-10-12: Public Disclosure ########################### CSRF PoC ############################### <------ CSRF POC ------> --------------------------------------------------------------------------- Solution: Patch is available. Install patch using the ATutor Patcher. Link to download patch: http://update.atutor.ca/patch/2_2_2/2_2_2-6/patch.xml ---------------------------------------------------------------------------