CVE-2019-16114

In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution. This occurs because install/include/header.php does not restrict certain changes (to db_host, db_login, db_password, and content_dir) within install/include/step5.php.

• CWE-863

• https://github.com/MostafaSoliman/Security-Advisories/blob/master/CVE-2019-16114/README.mdExploit, Third Party Advisory
• https://github.com/atutor/ATutor/commits/masterPatch
• https://github.com/MostafaSoliman/Security-Advisories/blob/master/CVE-2019-16114/README.mdExploit, Third Party Advisory
• https://github.com/atutor/ATutor/commits/masterPatch

Published

Sep 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16108phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheet…7.5
• CVE-2019-16109An issue was discovered in Plataformatec Devise before 4.7.1…5.3
• CVE-2019-1611A vulnerability in the CLI of Cisco NX-OS Software and Cisco…6.7
• CVE-2019-16110The network protocol of Blade Shadow though 2.13.3 allows re…8.1
• CVE-2019-16112TylerTech Eagle 2018.3.11 deserializes untrusted user input,…8.8
• CVE-2019-16113Bludit 3.9.2 allows remote code execution via bl-kernel/ajax…8.8
• CVE-2019-16115In Xpdf 4.01.01, a stack-based buffer under-read could be tr…7.8
• CVE-2019-16116EnterpriseDT CompleteFTP Server prior to version 12.1.3 is v…4.3
• CVE-2019-16117Cross site scripting (XSS) in the photo-gallery (10Web Photo…6.1
• CVE-2019-16118Cross site scripting (XSS) in the photo-gallery (10Web Photo…6.1
• CVE-2019-16119SQL injection in the photo-gallery (10Web Photo Gallery) plu…9.8
• CVE-2019-1612A vulnerability in the CLI of Cisco NX-OS Software could all…4.2