PT-2004-3057 · Tutos · Tutos

Joxean Koret · Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2162

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TUTOS version 1.1

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via two main avenues: the search field of the Address Module or the t parameter to "app new.php".

Recommendations For TUTOS version 1.1, consider disabling the search field in the Address Module and restricting access to the "app new.php" endpoint to minimize the risk of exploitation. Avoid using the t parameter in the "app new.php" endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2004-2162

DSA-980-1

Produtos afetados

Tutos

Referências · 9

• 🔥 https://exploit-db.com/exploits/24617 · Exploit
• 🔥 http://securityfocus.com/archive/1/375757 · Exploit
• http://secunia.com/advisories/12606 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17445 · Nota
• http://secunia.com/advisories/18954 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2162 · Nota de Segurança
• http://securityfocus.com/bid/11221 · Nota
• http://cvs.sourceforge.net/viewcvs.py/tutos/tutos/php/app_new.php?r1=1.58&r2=1.59 · Nota
• http://debian.org/security/2006/dsa-980 · Aviso do Fabricante