CVE-2006-3662 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 1.3% (pctl 69)
Patch early
A public exploit exists.
Description
SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible." However, the relevant source code suggests that this issue may be legitimate, and the parameter is cleansed in 1.5.3.1
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 1.25% — more likely to be exploited than 69% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-07-18 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| adaptive technology resource centre | atutor |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | ATutor 1.5.3 - Multiple Input Validation Vulnerabilities | 2006-07-08 |
References
- http://archives.neohapsis.com/archives/bugtraq/2006-07/0096.html
- http://www.osvdb.org/28188
- http://www.securityfocus.com/archive/1/439873/100/100/threaded
- http://www.securityfocus.com/archive/1/440837/100/100/threaded
- http://www.securityfocus.com/bid/18898
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27620
- http://archives.neohapsis.com/archives/bugtraq/2006-07/0096.html
- http://www.osvdb.org/28188
- http://www.securityfocus.com/archive/1/439873/100/100/threaded
- http://www.securityfocus.com/archive/1/440837/100/100/threaded
- http://www.securityfocus.com/bid/18898
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27620
→ the Explorer · watch your stack · NVD