CVE-2005-3404

Name of the Vulnerable Software and Affected Versions ATutor versions 1.4.1 through 1.5.1-pl1

Description The issue allows remote attackers to include arbitrary files via the section parameter followed by a null byte (%00) in files such as body header.inc.php and print.php.

Recommendations For ATutor versions 1.4.1 through 1.5.1-pl1, consider restricting access to the section parameter to prevent the inclusion of arbitrary files until a patch is available. Avoid using the section parameter followed by a null byte (%00) in the affected files, such as body header.inc.php and print.php, to minimize the risk of exploitation.