CVE-2008-3368: PHP remote file inclusion vulnerability in tools/packages/import.php in ATutor 1.6.1 pl1 and earlier allows...

Security readout for executives and security teams

This vulnerability affects old ATutor installations. An authenticated administrator could cause the application to load remote PHP content through the package import function, leading to arbitrary server-side code execution. The main business risk is compromise of the ATutor server if an administrator account is abused or malicious. Exposure is limited to ATutor 1.6.1 pl1 and earlier, especially systems where the package import functionality is reachable by administrator users. Organizations running legacy ATutor instances, internet-facing LMS portals, or unmanaged academic systems should verify version and administrative access controls. Treat this as a legacy high-impact risk, not an internet-wide emergency. Prioritize if ATutor is still deployed, internet-facing, or administered by shared accounts. If no ATutor instance exists, document non-exposure and close. Mitigation focus: Identify any ATutor instances and confirm their exact version.; Check ATutor or vendor guidance for a fixed release or supported upgrade path.; Retire or isolate ATutor 1.6.1 pl1 and earlier if no supported fix exists..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.