ATutor versions 2.2 and below suffer from a session variable overloading vulnerability. Continue reading...