CVE-2016-2555

This Metasploit module exploits a SQL injection vulnerability (CVE-2016-2555) in ATutor 2.2.1, allowing authentication bypass and remote code execution via malicious plugin upload. It leverages a SQLi in the social connections search feature to extract admin credentials and uploads a PHP payload.

This repository contains a functional exploit for CVE-2016-2555, targeting ATutor. The exploit demonstrates an authentication bypass via type juggling, password reset, and arbitrary file upload leading to remote code execution.

This repository contains a functional Python script that exploits a blind SQL injection vulnerability in ATutor v2.2.1 (CVE-2016-2555). The script automates the enumeration and dumping of the underlying database by leveraging content-length differences in HTTP responses.

This repository contains a functional exploit for CVE-2016-2555, targeting ATutor 2.2.1. It combines SQL injection to extract credentials and a pass-the-hash attack to bypass authentication, followed by a ZIP file upload to achieve remote code execution.

This Metasploit module exploits a directory traversal vulnerability in ATutor 2.2.1, allowing remote code execution by uploading a malicious ZIP file. It also includes authentication bypass techniques via type juggling and TOCTOU vulnerabilities.

This Metasploit module exploits a SQL injection vulnerability (CVE-2016-2555) in ATutor 2.2.1 to bypass authentication, dump administrator credentials, and achieve remote code execution by uploading a malicious PHP plugin.