ATutor’s registration form accepts input in the phone field without proper filtering. An attacker can register an account with a JavaScript payload in this field; when any authenticated user views the attacker’s public profile, the template echoes the phone value unescaped, resulting in browser execution of the payload. The executed script can steal the user’s session cookie, enabling an attacker to hijack that user’s session.

ATutor version 2.2.4 has been confirmed vulnerable; other versions were not specifically tested but may also be affected. The product is no longer actively supported and no fix has been released.

The CVSS score of 5.1 indicates moderate severity. No EPSS information is available and the vulnerability is not listed in CISA’s KEV catalog. Attackers only need to register a malicious account; the exploit does not require advanced privileges or remote code execution. The risk is that any authenticated user who views the malicious profile will have their session compromised, but it does not affect the broader system beyond the attacker’s immediate ability to hijack sessions.