Marcin Wyczechowski

**Name of the Vulnerable Software and Affected Versions** Dool versions prior to 1.3.9 **Description** The software is susceptible to CSV injection during the data export process to CSV files. This occurs because the application fails to sanitize cell content that begins with special formula characters such as `=`, `+`, `-`, or `@`. A local attacker can exploit this by creating a process with a crafted name starting with `=`, which injects malicious formulas into the CSV output. These formulas are then executed when a victim opens the resulting file in a spreadsheet application. **Recommendations** Update Dool to version 1.3.9 or later.

**Name of the Vulnerable Software and Affected Versions** Dool versions prior to 1.3.9 **Description** The application is susceptible to symlink following when the `--devel` flag is active. This occurs because the software opens a log file without the `O NOFOLLOW` flag, which is a system-level instruction that prevents the application from following symbolic links. A local attacker can create a symlink at the expected log file path that points to a sensitive file, leading the application to truncate and overwrite the target file with log data. This impact is increased if the application is executed with elevated privileges. **Recommendations** Update to version 1.3.9 or later. As a temporary mitigation, avoid using the `--devel` flag.

**Name of the Vulnerable Software and Affected Versions** GNU wget versions prior to 1.25.0 **Description** GNU wget is susceptible to a denial of service in its FTP OPIE/S-KEY authentication functionality. The issue occurs because the software uses a server-supplied sequence number from the FTP challenge line as an iteration count for an MD5 key-derivation loop without validating an upper bound. A malicious FTP server or a network attacker capable of intercepting traffic can send a crafted OPIE challenge with a sequence number near `INT MAX`, forcing the application to perform approximately 2.1 billion MD5 computations. This results in the application suspending for a significant period. The `--timeout` option is ineffective as it only applies to network I/O and not CPU computation. **Recommendations** Update GNU wget to version 1.25.0 or later.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** A path traversal vulnerability allows an authenticated user to access files from other course directories. This occurs when the `AT FORCE GET FILE` configuration option is enabled, potentially leading to unauthorized file access and disclosure of the filesystem structure. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable the `AT FORCE GET FILE` configuration option to mitigate the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** An authenticated attacker can perform a Reflected Cross-Site Scripting (XSS) attack via the `popup` parameter in the 'preview.php' endpoint. By injecting a double quote into the `popup` parameter, the attacker can break out of the attribute value and append a new event handler, such as `onload`. Although the 'preview top.php' file sanitizes these parameters, it does not prevent XSS within the parent frameset rendered by 'preview.php'. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** The Gameme module allows authenticated users to upload files of any type and extension without restriction. Because files are stored in a web-accessible location before content validation, an attacker with a valid `course id` (often `course id=0` for global context) can upload a server-executable malicious script. Requesting this file over HTTP leads to remote code execution with the privileges of the web server process user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** Stored Cross Site Scripting (XSS) exists in the registration functionality. An attacker can register a new account and inject a JavaScript payload into the `phone` field. When an authenticated user views the attacker's public profile, the profile template renders the `phone` value without output encoding, causing the browser to execute the payload and potentially allowing the theft of the user's session cookie. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** A path traversal vulnerability exists in the error log viewer. This flaw allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory, potentially leading to unauthorized access to sensitive files and other resources accessible to the web server process. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** An authorization bypass exists where a low-privileged authenticated user, such as a student enrolled in a course, can send requests directly to the backend import endpoints. This allows the unauthorized import of tests and questions within a course. The affected endpoints are the Test and Question Import endpoints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** An Insecure Direct Object Reference (IDOR) exists in endpoints related to profile pictures. An authenticated user can provide a different user's `member id` within a POST request to the profile album endpoint to permanently delete that user's profile picture, regardless of whether the target is a student, instructor, or administrator. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** A Path Traversal issue exists in the ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive to write files outside the intended directory. This allows the placement of a server-executable `.phtml` file in the web root, leading to remote code execution with web server privileges on the underlying server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** The profile update functionality is susceptible to Cross-Site Request Forgery (CSRF), a flaw where a web application fails to verify that a request was intentionally initiated by the user. An attacker can create a malicious website that, when accessed by an authenticated user, sends a forged request to the system. Because the application lacks proper CSRF token implementation, it processes the request, enabling the attacker to modify the profile fields of the user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** An authenticated administrator can perform Server-Side Request Forgery (SSRF) through import functionalities. This allows the server to make requests to arbitrary internal HTTP endpoints, cloud metadata services, or local files using the `file://` wrapper, provided the PHP environment permits URL wrappers. SSRF is a flaw where an attacker induces a server-side application to make requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** An authentication bypass exists in the auto-login functionality. While a token validation check is implemented, the values required for this validation remain uninitialized in specific code paths. An unauthenticated attacker who obtains a user's identifier and registration timestamp can generate a valid token to authenticate as any existing user, including administrators, without providing a password. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** Reflected Cross-Site Scripting (XSS) exists in the restore functionality. This occurs when an attacker provides a specially crafted URL that, if opened by a victim, executes arbitrary JavaScript in the victim's browser. Reflected XSS is a type of attack where a malicious script is reflected off a web application to the victim's browser. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ATutor version 2.2.4 **Description** The account confirmation functionality generates predictable email confirmation tokens because it uses insufficiently random values related to user registration. An attacker capable of predicting these values can guess valid activation tokens to activate an unconfirmed account without accessing the victim's email inbox. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** nnn version 5.2 **Description** The software fails to sanitize the `path` variable. An attacker can create a directory on a shared filesystem, removable media, or within an extracted archive using a name that contains a single quote followed by shell syntax. When a user enters this directory and utilizes the batch copy or move workflow, the crafted directory name is embedded into the generated shell command, allowing the injected payload to execute with the privileges of the process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** nnn version 5.2 **Description** The software fails to sanitize the `filename` variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or within an extracted archive. If the filename contains a single quote followed by shell syntax and a victim opens it using preview-tabbed, the filename is embedded into a generated shell command, allowing the injected payload to execute with the privileges of the nnn process. **Recommendations** As a temporary workaround, avoid opening files from untrusted sources using preview-tabbed in nnn version 5.2. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** nnn version 5.2 **Description** An Out-of-Bound write issue exists due to insufficient validation of attacker-controlled length fields during the deserialization of session files. When a crafted session file is loaded using the `-s` option, the application may write data beyond the boundaries of fixed-size global buffers. This allows an attacker who can place a malicious session file in the session directory to corrupt adjacent global state. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** nnn version 5.2 **Description** The software stores the `homelen` variable as a `uchar t`, which limits its range to 0-255. An attacker capable of influencing the execution environment can provide a HOME path with a length that is truncated to 0. This causes the expression `(homelen - 1)` to be promoted to a signed integer and become -1, resulting in an out-of-bounds read and an out-of-bounds write one byte before the path buffer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.