CVE-2006-3662

Name of the Vulnerable Software and Affected Versions ATutor version 1.5.3

Description A SQL injection issue in index.php allows remote attackers to execute arbitrary SQL commands via the fid parameter. The vendor has disputed this issue, stating it is not possible, but the source code suggests it may be legitimate. The parameter is cleansed in version 1.5.3.1.

Recommendations For ATutor version 1.5.3, update to version 1.5.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the fid parameter in the index.php file until the update can be applied.