CVE-2019-12170: ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) componen

ATutor (an educational software platform) versions through 2.2.4 have a vulnerability in their backup upload component that allows attackers to upload malicious files without proper restrictions. An attacker with instructor account access can upload a crafted ZIP file containing PHP code (a server-side programming language), which gets written to the web server and executed, giving them complete control over the system through RCE (remote code execution, where an attacker can run commands on a system they don't own).