François Sorin

Name of the Vulnerable Software and Affected Versions: TUTOS version 1.1 Description: The issue allows remote attackers to insert arbitrary web script, as demonstrated using the `msg` parameter to "file select.php" API endpoint. This can lead to cross-site scripting (XSS) attacks. Recommendations: For TUTOS version 1.1, avoid using the `msg` parameter in the "file select.php" API endpoint until the issue is resolved. Consider restricting access to the file select.php endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: TUTOS version 1.1 Description: The issue allows remote attackers to execute arbitrary code. This is achieved by uploading the code using the `file new.php` endpoint, then directly accessing the uploaded code via a request to the repository containing the code. Recommendations: For TUTOS version 1.1, consider restricting access to the `file new.php` endpoint to prevent unauthorized code uploads until a fix is available. Additionally, restrict direct access to the repository to minimize the risk of exploitation.