CVE-2014-9753 (published 2020-02-11T18:15Z)

confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/atutor/ATutor
commit_details: repo_url: https://github.com/atutor/ATutor
author: George Buckingham
author_date: 2014-08-25 09:20:35+01:00
msg: Added a confirmation code to auto_login URL to fix bug where anyone can login as anyone.
repository: repo_url: https://github.com/atutor/ATutor
repo_name: atutor/ATutor
description: NO LONGER USER LEVEL SUPPORTED. CONTRIBUTING DEVELOPERS INTERESTED IN MAINTAINING ATUTOR, SHOULD REQUEST COLLABORATOR ACCESS. : ATutor is an Open Source Web-based Learning Management System (LMS) used to develop and deliver online courses. Administrators can install or update ATutor in minutes, develop custom themes to give ATutor a new look, and easily extend its functionality with feature modules. Educators can quickly assemble, package, and redistribute standardized Web-based instructional content, easily import prepackaged content, and conduct their courses online. Students learn in an accessible, adaptive, social learning environment.
repo_language: PHP
owner: atutor
file_changes: filename: confirm.php
change_type: ModificationType.MODIFY
diff: @@ -82,7 +82,7 @@ if (isset($_GET['e'], $_GET['id'], $_GET['m'])) {
 				require(AT_INCLUDE_PATH.'header.inc.php');
 				echo "<div class=\"input-form\">";
 				require(AT_INCLUDE_PATH.'html/auto_enroll_list_courses.inc.php');
-				echo '<p style="text-align:center"><a href="'. $_SERVER['PHP_SELF'] . '?auto_login=1&member_id='. $id .'">' . _AT("go_to_my_start_page") . '</a></p>';
+				echo '<p style="text-align:center"><a href="'. $_SERVER['PHP_SELF'] . '?auto_login=1&member_id='. $id .'&code=' . $code .'">' . _AT("go_to_my_start_page") . '</a></p>';
 				echo "</div>";
 				require(AT_INCLUDE_PATH.'footer.inc.php');
 				exit;
@@ -94,6 +94,7 @@ if (isset($_GET['e'], $_GET['id'], $_GET['m'])) {
 				// enable auto login student into "my start page"
 				$_REQUEST["auto_login"] = 1;
 				$_REQUEST["member_id"] = $id;
+				$_REQUEST["code"] = $code;
 			}
 		} else {
 			$msg->addError('CONFIRM_BAD');
@@ -142,8 +143,10 @@ if (isset($_REQUEST['auto_login']))
 	
 	$sql = "SELECT M.member_id, M.login, M.preferences, M.language FROM %smembers M WHERE M.member_id=%d";
 	$row = queryDB($sql, array(TABLE_PREFIX, $_REQUEST["member_id"]), TRUE);
+
+	$code = substr(md5($e . $row['creation_date'] . $id), 0, 10);
 	
-	if ($row['member_id'] != '') 
+	if ($row['member_id'] != '' && isset($_REQUEST['code']) && $_REQUEST['code'] == $code) 
 	{
 		$_SESSION['valid_user'] = true;
 		$_SESSION['member_id']	= $_REQUEST["member_id"];

programming_language: PHP