Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.8
CVSSv3

CVE-2016-2555

Published: 13/04/2017 Updated: 14/02/2024
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 759
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Atutor

Vulnerability Summary

SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote malicious users to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

atutor atutor 2.2.1

Exploits

Exploit DB: ATutor 2.2.1 - SQL Injection / Remote Code Execution (Metasploit)
## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper def initialize(info={}) super(updat ...

Github Repositories

https://github.com/s0wr0b1ndef/OSWE

AWAE/OSWE Preparation for coming AWAE Training Work in progress Atmail Mail Server Appliance: from XSS to RCE (64) CVE-2012-2593 wwwexploit-dbcom/exploits/20009 githubcom/sourceincite/poc/blob/master/SRC-2016-0012py ATutor Authentication Bypass and RCE (221) CVE-2016-2555 Install: sourceforgenet/projects/atutor/files/atutor_2_2_1/

https://github.com/timip/OSWE

OSWE Preparation

AWAE/OSWE Preparation for coming AWAE Training Work in progress Atmail Mail Server Appliance: from XSS to RCE (64) CVE-2012-2593 wwwexploit-dbcom/exploits/20009 githubcom/sourceincite/poc/blob/master/SRC-2016-0012py ATutor Authentication Bypass and RCE (221) CVE-2016-2555 Install: sourceforgenet/projects/atutor/files/atutor_2_2_1/

https://github.com/svdwi/OWSE-Labs

Dockerized labs For Web Expert (OSWE) certification. Preparation for coming AWAE Training ...

OSWE -LABS Dockerized labs For Web Expert (OSWE) certification Preparation for coming AWAE Training Another project : malware analysis & cyber threat hunting githubcom/svdwi/BlueBox Available labs for the OSWE ATutor is an Open Source Web-based Learning Content Management System Wikipedia DNN is a web content management system and web application fr

https://github.com/MdTauheedAlam/AWAE-OSWE-Notes

AWAE/OSWE Preparation for coming AWAE Training Work in progress Atmail Mail Server Appliance: from XSS to RCE (64) CVE-2012-2593 wwwexploit-dbcom/exploits/20009 githubcom/sourceincite/poc/blob/master/SRC-2016-0012py ATutor Authentication Bypass and RCE (221) CVE-2016-2555 Install: sourceforgenet/projects/atutor/files/atutor_2_2_1/

https://github.com/mishmashclone/timip-OSWE

https://github.com/timip/OSWE

AWAE/OSWE Preparation for coming AWAE Training Work in progress Atmail Mail Server Appliance: from XSS to RCE (64) CVE-2012-2593 wwwexploit-dbcom/exploits/20009 githubcom/sourceincite/poc/blob/master/SRC-2016-0012py ATutor Authentication Bypass and RCE (221) CVE-2016-2555 Install: sourceforgenet/projects/atutor/files/atutor_2_2_1/

https://github.com/shadofren/CVE-2016-2555

CVE-2016-2555

CVE-2016-2555 CVE-2016-2555

https://github.com/mishmashclone/ManhNho-AWAE-OSWE

https://github.com/ManhNho/AWAE-OSWE

AWAE/OSWE Preparation for coming AWAE Training Work in progress Facebook discuss group wwwfacebookcom/groups/262623168007439 Course syllabus wwwoffensive-securitycom/documentation/awae-syllabuspdf Other resource Burpsuite how to? portswiggernet/burp/documentation Common web vulnerabilities portswiggernet/web-security Atmail Mai

https://github.com/kymb0/web_study

my n00b notes on web_study

stop what you are doing and have a glance through this: wwwinfosecmattercom/bug-bounty-tips/ web_study my n00b notes on web_study The Single Page badge on PA doesnt tell you where the exercises are they are here A good list of "todo's" is here at mrb3n's blog To do: Portswigger labs will take you from 0 to hero LKWA ^^^ lab guide Hack the Box/ B

https://github.com/svdwi/OSWE-Labs-Poc

Dockerized labs For Web Expert (OSWE) certification. Preparation for coming AWAE Training ...

OSWE -LABS Dockerized labs For Web Expert (OSWE) certification Preparation for coming AWAE Training Another project : malware analysis & cyber threat hunting githubcom/svdwi/BlueBox Available labs for the OSWE ATutor is an Open Source Web-based Learning Content Management System Wikipedia DNN is a web content management system and web application fr

https://github.com/BLACKHAT-SSG/OSWE-Preparation-

Do all these topics and learn advance web hacking as well prepare for OSWE.

AWAE/OSWE Preparation for coming AWAE Training Work in progress Atmail Mail Server Appliance: from XSS to RCE (64) CVE-2012-2593 wwwexploit-dbcom/exploits/20009 githubcom/sourceincite/poc/blob/master/SRC-2016-0012py ATutor Authentication Bypass and RCE (221) CVE-2016-2555 Install: sourceforgenet/projects/atutor/files/atutor_2_2_1/

https://github.com/maximilianmarx/atutor-blind-sqli

Exploiting CVE-2016-2555 enumerating and dumping the underlying Database.

ATutor v221 Blind SQL Injection Exploiting CVE-2016-2555 enumerating and dumping the underlying Database Disclaimer All the information provided in this post is for educational purposes only You shall not misuse the information to gain unauthorized access and/or write malicious programs The author is not responsible for misuse of this information

https://github.com/shreyaschavhan/oswe-awae-pre-preperation-plan-and-notes

My OSWE Pre-preperation (i.e. before acutally buying the course) phase plan and notes!

Notes/Plan for my own personal reference! πŽπ’π–π„/𝐀𝐖𝐀𝐄 𝐏𝐫𝐞-𝐏𝐫𝐞𝐩𝐞𝐫𝐚𝐭𝐒𝐨𝐧 𝐏π₯𝐚𝐧 𝐚𝐧𝐝 𝐍𝐨𝐭𝐞𝐬 Started : 16-09-2022 Expected : ?? Donno ?? [bcz of college Assignments/ Exams/ Projects College Sucks] Oct to Dec: Got Distracted with bug-bounties + Co

References

CWE-89https://github.com/atutor/ATutor/commit/945a9dca01def8536516088da30fe6a4b7e9fa85https://github.com/atutor/ATutor/commit/629b2c992447f7670a2fecc484abfad8c4c2d298http://www.rapid7.com/db/modules/exploit/multi/http/atutor_sqlihttp://sourceincite.com/research/src-2016-08/https://www.exploit-db.com/exploits/39514/https://nvd.nist.govhttps://www.exploit-db.com/exploits/39514/https://github.com/timip/OSWE
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
hardcodedarbitrary codeCVE-2024-2404CVE-2024-21111CVE-2024-28627CVE-2024-4073information disclosureCVE-2024-32780CVE-2024-4040
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook