PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-2539 Atutor CVE debrief

CVE-2016-2539 is a high-severity CSRF issue in ATutor before 2.2.2. The flaw affects install_modules.php and can be abused when an authenticated user is induced to send a crafted request, potentially leading to arbitrary file upload and execution of PHP code. NVD rates the issue CVSS 8.8 with UI:R, PR:N, and high impact across confidentiality, integrity, and availability.

Vendor
Atutor
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-07
Original CVE updated
2026-05-13
Advisory published
2017-02-07
Advisory updated
2026-05-13

Who should care

ATutor administrators, LMS operators, and security teams responsible for web applications that allow module installation or file upload workflows should prioritize this issue, especially if any instance may still be on a version earlier than 2.2.2.

Technical summary

NVD describes the vulnerability as cross-site request forgery in install_modules.php in ATutor before 2.2.2. The attack requires user interaction because a victim must be tricked into submitting a malicious request, but no privileges are needed on the attacker side. The reported impact includes unauthorized file upload and arbitrary PHP code execution, which aligns with the high CVSS impact score and the CWE-352 classification.

Defensive priority

High priority. This is a network-reachable web application flaw with severe potential impact, and the vulnerable version range includes ATutor through 2.2.1.

Recommended defensive actions

  • Upgrade ATutor to 2.2.2 or later, as indicated by the vulnerability record and vendor patch reference.
  • Review any exposed module installation or upload functionality for CSRF protections, including request validation and anti-CSRF tokens.
  • Verify that authenticated administrative actions cannot be triggered by cross-site requests.
  • Audit the application for unexpected uploaded files or other signs of abuse if a vulnerable version was used.
  • Limit access to administrative interfaces and minimize exposure of module-management endpoints until remediation is complete.

Evidence notes

The vulnerability details come from the NVD record and CVE entry, which identify ATutor versions through 2.2.1 as affected and classify the weakness as CWE-352. The supplied references also include a vendor GitHub commit associated with the fix, plus third-party advisory pages that corroborate the issue. The CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which supports a high defensive priority.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-2539 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-2539

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-2539 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-2539

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.