CVE-2016-2555

SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.

• CWE-89

• http://sourceincite.com/research/src-2016-08/Exploit, Third Party Advisory, URL Repurposed
• http://www.rapid7.com/db/modules/exploit/multi/http/atutor_sqliThird Party Advisory, VDB Entry
• https://github.com/atutor/ATutor/commit/629b2c992447f7670a2fecc484abfad8c4c2d298Patch, Third Party Advisory
• https://github.com/atutor/ATutor/commit/945a9dca01def8536516088da30fe6a4b7e9fa85Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/39514/
• http://sourceincite.com/research/src-2016-08/Exploit, Third Party Advisory, URL Repurposed
• http://www.rapid7.com/db/modules/exploit/multi/http/atutor_sqliThird Party Advisory, VDB Entry
• https://github.com/atutor/ATutor/commit/629b2c992447f7670a2fecc484abfad8c4c2d298Patch, Third Party Advisory
• https://github.com/atutor/ATutor/commit/945a9dca01def8536516088da30fe6a4b7e9fa85Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/39514/

Published

Apr 13, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2547sound/core/timer.c in the Linux kernel before 4.4.1 employs …
• CVE-2016-2548sound/core/timer.c in the Linux kernel before 4.4.1 retains …
• CVE-2016-2549sound/core/hrtimer.c in the Linux kernel before 4.4.1 does n…
• CVE-2016-2550The Linux kernel before 4.5 allows local users to bypass fil…
• CVE-2016-2553Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-2554Stack-based buffer overflow in ext/phar/tar.c in PHP before …
• CVE-2016-2556The Escape interface in the Kernel Mode Driver layer in the …7.8
• CVE-2016-2557The Escape interface in the Kernel Mode Driver layer in the …8.4
• CVE-2016-2558The Escape interface in the Kernel Mode Driver layer in the …8.4
• CVE-2016-2559Cross-site scripting (XSS) vulnerability in the format funct…
• CVE-2016-2560Multiple cross-site scripting (XSS) vulnerabilities in phpMy…
• CVE-2016-2561Multiple cross-site scripting (XSS) vulnerabilities in phpMy…