Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
ATutor-2.2.4-Language-Exploit — Python exploit for ATutor 2.2.4 leveraging arbitrary file upload via ZIP path traversal to achieve remote code execution (CVE-2019-12169). | Kitploit
Tools/GitHubGitHub/fuzzlove/atutor-2.2.4-language-exploit
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubfuzzlove/atutor-2.2.4-language-exploit

ATutor-2.2.4-Language-Exploit

Python exploit for ATutor 2.2.4 leveraging arbitrary file upload via ZIP path traversal to achieve remote code execution (CVE-2019-12169).

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
View Repository
4327 years agoNot yet reviewed
Share

ATutor 2.2.4 Arbitrary File Upload / RCE (CVE-2019-12169)

  • Exploit Title: ATutor 2.2.4 Arbitrary File Upload / RCE [CVE-2019-12169]
  • Date: 5/24/19
  • Exploit Author: liquidsky (JMcPeters)
  • Vendor Homepage: https://atutor.github.io/
  • Software Link: https://sourceforge.net/projects/atutor/files/latest/download
  • Version: 2.2.4
  • Tested on: Windows 8 / Apache / MySQL (XAMPP)
  • CVE : CVE-2019-12169 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12169
  • Author Site: http://incidentsecurity.com | https://github.com/fuzzlove

Description: ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component.

Greetz: wetw0rk, offsec ^^

Notes: This application is no longer being maintained so there is no fix for this issue.

update: if you wish to test this manually I have included the poc.zip for a better understanding.

  • CVE-2019-12170: https://github.com/fuzzlove/ATutor-Instructor-Backup-Arbitrary-File
  • CVE-2019-12169: https://github.com/fuzzlove/ATutor-2.2.4-Language-Exploit
Download Tool