ATutor <= 1.5.5 Cross Site Scripting Feb 17 2008 11:01PM
L4teral (l4teral gmail com)
ATutor <= 1.5.5 Cross Site Scripting

Author: L4teral <l4teral [4t] gmail com>
Impact: Cross Site Scripting
Status: patch available

Affected software description:

Application: ATutor
Version: <= 1.5.5
Vendor: http://www.atutor.ca

ATutor is an Open Source Web-based Learning Content Management System
(LCMS) designed with accessibility and adaptability in mind.
Administrators can install or update ATutor in minutes, develop custom
templates to give ATutor a new look, and easily extend its
functionality with feature modules. Educators can quickly assemble,
package, and redistribute Web-based instructional content, easily
retrieve and import prepackaged content, and conduct their courses
online. Students learn in an adaptive learning environment.


The mail and forum components are vulnerable to cross site scripting.
Script code can be embedded into the user profile.


create forum post/mail with:
http://www.ex"style="width:expression(alert('xss'))"ample.com (IE only)

create forum post/mail with:

use the following as website in the profile:


update to version 1.6 or above.


2007-10-17 - vendor informed
2007-10-18 - vendor responded
2008-02-05 - vendor released new version
2008-02-17 - public disclosure

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus