PT-2006-4529 · Atutor · Atutor

Published 2006-07-17 · Updated 2024-08-07 · CVE-2006-3662

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ATutor version 1.5.3

Description A SQL injection issue in index.php allows remote attackers to execute arbitrary SQL commands via the fid parameter. The vendor has disputed this issue, stating it is not possible, but the source code suggests it may be legitimate. The parameter is cleansed in version 1.5.3.1.

Recommendations For ATutor version 1.5.3, update to version 1.5.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the fid parameter in the index.php file until the update can be applied.

Exploit

Fix

Related Identifiers

CVE-2006-3662

Affected Products

Atutor

References · 10

• 🔥 https://exploit-db.com/exploits/28192 · Exploit
• 🔥 http://securityfocus.com/bid/18898 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2006-07/0096.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3662 · Security Note
• http://osvdb.org/28188 · Note
• http://securityfocus.com/archive/1/440837/100/100/threaded · Note
• https://t.me/cvenotify/89796 · Telegram Post
• http://securityfocus.com/archive/1/439873/100/100/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27620 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3662 · Note