An unrestricted file upload vulnerability in the ATutor Gameme module allows authenticated users to execute arbitrary code on the server.

This is an unrestricted upload of a file with a dangerous type (CWE-434). The vulnerability exists within the Gameme module and requires the attacker to be an authenticated user to perform the upload.

A successful exploit allows an authenticated user to bypass security controls and upload malicious files, which can lead to remote code execution. This poses a severe risk of full system compromise, unauthorized data access, and potential lateral movement within the network. The CVSS score of 8.7 underscores the critical nature of this flaw.

Immediate Action: Restrict access to the Gameme module until a security patch is provided by the vendor. If the module is not required for business operations, it should be disabled.

Proactive Monitoring: Audit the server for newly created files in upload directories and monitor for suspicious web requests targeting the Gameme module.

Compensating Controls: Configure the web server to disable script execution in upload directories and implement a Web Application Firewall (WAF) to filter file extensions and content-types.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete system compromise, organizations using ATutor 2.2.4 must treat this as a high-priority incident. Disable the vulnerable Gameme module immediately and continue monitoring vendor channels for the release of a permanent patch.