Description
Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to inject arbitrary web script or HTML via (1) the _base_href parameter in translate.php, (2) the _base_path parameter in news.inc.php, and (3) the p parameter in add_note.php.
References
- 20051027 Secunia Research: ATutor Multiple Vulnerabilities mailing-list
- ADV-2005-2228 vdb-entry
- 16915 third-party-advisory
- 20348 vdb-entry
- 20349 vdb-entry
- 123 third-party-advisory
- 1015165 vdb-entry
- 15221 vdb-entry
- http://atutor.ca/view/3/6158/1.html
- http://secunia.com/secunia_research/2005-55/advisory/
- 20347 vdb-entry