Tutos Multiple Remote Input Validation Vulnerabilities

Bugtraq ID:	11221
Class:	Input Validation Error
CVE:	CVE-2004-2161 CVE-2004-2162
Remote:	Yes
Local:	No
Published:	Sep 20 2004 12:00AM
Updated:	Jul 11 2006 10:58PM
Credit:	Discovery is credited to Joxean Koret <[email protected]>.
Vulnerable:	Tutos Tutos 1.1 .20040414 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1
Not Vulnerable:

Tutos Multiple Remote Input Validation Vulnerabilities

Tutos is reported prone to multiple remote input-validation vulnerabilities. These issues exist due to insufficient sanitization of user-supplied data and may allow an attacker to carry out cross-site scripting and SQL-injection attacks.

These issue reportedly affect Tutos 1.1.2004-04-14.

Tutos Multiple Remote Input Validation Vulnerabilities

No exploit is required.

The following proof-of-concept examples are available:
http://www.example.com/file/file_overview.php?link_id=1005'asdf

http://www.example.com/app_new.php?t=200408240<script>alert(document.cookie)</script>

Tutos Multiple Remote Input Validation Vulnerabilities

Solution:
This issue has been addressed in the CVS.

Debian advisory DSA 980-1 is available to address these issues. Please see the referenced advisory for more information.

Tutos Multiple Remote Input Validation Vulnerabilities

References:

• Tutos Homepage (Tutos)
  
• Vulnerabilities in TUTOS (Joxean Koret )