What’s Vulnerable › Vulnerabilities

CVE-2016-2555

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 79.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-04-13 · updated 2026-06-17
• Weakness: CWE-89

Description

SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.

Affected products

• ATutor: 2.2.1

References

• http://sourceincite.com/research/src-2016-08/
• http://www.rapid7.com/db/modules/exploit/multi/http/atutor_sqli
• https://github.com/atutor/ATutor/commit/629b2c992447f7670a2fecc484abfad8c4c2d298
• https://github.com/atutor/ATutor/commit/945a9dca01def8536516088da30fe6a4b7e9fa85
• https://www.exploit-db.com/exploits/39514/
• http://sourceincite.com/research/src-2016-08/
• http://www.rapid7.com/db/modules/exploit/multi/http/atutor_sqli
• https://github.com/atutor/ATutor/commit/629b2c992447f7670a2fecc484abfad8c4c2d298
• https://github.com/atutor/ATutor/commit/945a9dca01def8536516088da30fe6a4b7e9fa85
• https://www.exploit-db.com/exploits/39514/

Get alerted when CVE-2016-2555 or the next vulnerability affects your stack