Executive brief
ATutor is an open-source learning management system used by educational institutions to develop and manage online courses. A reflected cross-site scripting (XSS) vulnerability in the preview.php file allows authenticated attackers to inject malicious JavaScript code that executes in other users' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of victims.
Technical details
The vulnerability is a reflected XSS (CWE-79) in the popup parameter of preview.php. An authenticated attacker can inject a double quote to break out of an HTML attribute value and append event handlers such as onload. The related preview_top.php file performs sanitization but does not prevent XSS in the parent frameset rendered by preview.php itself. Attack requires authentication and the attacker crafting a malicious URL containing the XSS payload; the victim must then visit that URL. Version 2.2.4 is confirmed vulnerable; other versions are untested but potentially affected. No patch is available as the product is no longer actively maintained.
Affected products
- ATutor ATutor 2.2.4
Timeline
- 2026-08-20: disclosed
- 2026-08-20: advisory