ATutor does not enforce CSRF tokens when updating profile information, so an attacker can trick an authenticated user into visiting a malicious site that submits a forged request to the system. The forged request is processed successfully, allowing the attacker to change the victim’s profile fields. This flaw enables an attacker to alter user data without permission, impacting confidentiality of personal information and potentially facilitating further social engineering attacks.

ATutor, version 2.2.4, is confirmed vulnerable. The product was not actively supported and no patches have been released; other versions may also be affected but are untested.

The CVSS score of 5.1 indicates a moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote web-based CSRF attack where a malicious site is served to an authenticated user. Because the application lacks proper CSRF token validation, the attack does not require additional privileges or internal network access, making exploitation feasible against any user who logs in to the site.