CVE-2006-3662
** DISPUTED ** SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers...
SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible." However, the relevant source code suggests that this issue may be legitimate, and the parameter is cleansed in 1.5.3.1
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible." However, the relevant source code suggests that this issue may be legitimate, and the parameter is cleansed in 1.5.3.1
- Record
CVE-2006-3662- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible." However, the relevant source code suggests that this issue may be legitimate, and the parameter is cleansed in 1.5.3.1
- Record
CVE-2006-3662- Updated
- 2026-11-02
EUVDEUVD-2006-3657 No score
SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible." However, the relevant source code suggests that this issue may be legitimate, and the parameter is cleansed in 1.5.3.1
- Record
EUVD-2006-3657- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7hc5-m29w-554j No score
** DISPUTED ** SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers...
** DISPUTED ** SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible." However, the relevant source code suggests that this issue may be legitimate, and the parameter is cleansed in 1.5.3.1.
- Record
GHSA-7hc5-m29w-554j- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | ATutor 1.5.3 - Multiple Input Validation Vulnerabilities | 2006-07-08 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3662 is a high vulnerability (CVSS 7.5) in Adaptive Technology Resource Centre Atutor, published July 17, 2006. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile.
References
exchange.xforce.ibmcloud.com/vulnerabilities/27620
archives.neohapsis.com/archives/bugtraq/2006-07/0096.html
osvdb.org/28188
securityfocus.com/bid/18898
nvd.nist.gov/vuln/detail/CVE-2006-3662
github.com/advisories/GHSA-7hc5-m29w-554j