PT-2017-8054 · Atutor · Atutor

Mr_Me · Published 2017-04-13 · Updated 2024-02-14 · CVE-2016-2555

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ATutor version 2.2.1

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved through the searchFriends function to friends.inc.php.

Recommendations For ATutor version 2.2.1, consider disabling the searchFriends function in friends.inc.php until a patch is available to prevent potential SQL injection attacks.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-2555

Affected Products

Atutor

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atutor_sqli.rb · Exploit
• 🔥 https://github.com/shadofren/CVE-2016-2555 · Exploit
• 🔥 http://sourceincite.com/research/src-2016-08 · Exploit
• 🔥 https://exploit-db.com/exploits/39514 · Exploit
• https://github.com/atutor/ATutor/commit/945a9dca01def8536516088da30fe6a4b7e9fa85 · Patch
• https://github.com/atutor/ATutor/commit/629b2c992447f7670a2fecc484abfad8c4c2d298 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-2555 · Security Note
• https://osv.dev/vulnerability/CVE-2016-2555 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2555 · Note
• http://rapid7.com/db/modules/exploit/multi/http/atutor_sqli · Note