CVE-2006-3662: SQL Injection
DISPUTED SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible." However, the relevant source code suggests that this issue may be legitimate, and the parameter is cleansed in 1.5.3.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3662?
The severity of CVE-2006-3662 is disputed, as the vendor claims the SQL injection vulnerability is not possible.
How do I fix CVE-2006-3662?
To address CVE-2006-3662, you should consider updating to a more secure version of ATutor or implementing input validation and prepared statements.
What software does CVE-2006-3662 affect?
CVE-2006-3662 affects ATutor version 1.5.3 specifically.
What kind of attack is CVE-2006-3662 related to?
CVE-2006-3662 is related to SQL injection attacks, allowing unauthorized SQL command execution.
Is there any confirmation about the vulnerability in CVE-2006-3662?
CVE-2006-3662 remains disputed, with the vendor stating that the reported SQL injection vulnerability cannot be exploited.