PT-2004-3057 · Tutos · Tutos

Joxean Koret · Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2162

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TUTOS version 1.1

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via two main avenues: the search field of the Address Module or the t parameter to "app new.php".

Recommendations For TUTOS version 1.1, consider disabling the search field in the Address Module and restricting access to the "app new.php" endpoint to minimize the risk of exploitation. Avoid using the t parameter in the "app new.php" endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2004-2162

DSA-980-1

Affected Products

Tutos

References · 9

• 🔥 https://exploit-db.com/exploits/24617 · Exploit
• 🔥 http://securityfocus.com/archive/1/375757 · Exploit
• http://secunia.com/advisories/12606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2162 · Security Note
• http://debian.org/security/2006/dsa-980 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17445 · Note
• http://secunia.com/advisories/18954 · Note
• http://securityfocus.com/bid/11221 · Note
• http://cvs.sourceforge.net/viewcvs.py/tutos/tutos/php/app_new.php?r1=1.58&r2=1.59 · Note