CVE-2017-1000002

CVE-2017-1000002 is a critical directory traversal vulnerability affecting ATutor versions 2.2.1 and earlier. It allows attackers to bypass file extension checks in the Course component, leading to remote code execution, and also enables information disclosure via the Course Icon component. With a CVSS score of 9.8 (Critical), this vulnerability is easily exploitable over the network with low attack complexity, potentially resulting in complete compromise of confidentiality, integrity, and availability. While not on the CISA KEV catalog, a Metasploit module exists for exploitation, and the vulnerability has garnered significant community discussion, indicating a high likelihood of exploitation.