ATutor SQL Injection Vulnerability in Admin User Deletion Page

A SQL injection vulnerability has been identified in ATutor version 2.2.4, specifically on the admin user deletion page. This vulnerability allows authenticated attackers to manipulate database queries by injecting malicious SQL code into the 'id' parameter of the admin_delete.php script. Exploitation of this vulnerability could lead to unauthorized extraction or modification of database information.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to interfere with database queries. This could result in unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, log in as an admin user and navigate to the admin user deletion page. Inject a SQL payload into the 'id' parameter of the admin_delete.php script. The vulnerability can be exploited using SQLMap by specifying the injected 'id' parameter, along with the appropriate User-Agent and cookie information.