SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.

Joxean Koret discovered several security problems in tutos, a web-based team organization software. The Common Vulnerabilities and Exposures Project identifies the following problems :

  - CVE-2004-2161     A SQL injection vulnerability allows the execution of     SQL commands through the link_id parameter in     file_overview.php.

  - CVE-2004-2162     Cross-Site-Scripting vulnerabilities in the search     function of the address book and in app_new.php allow     the execution of web script code.

The remote host is running a vulnerable version of Tutos. It is reported that Tutos 1.1.20040414 is prone to multiple input validation weaknesses. Due to insufficient user input validation, an attacker may carry out SQL injection or cross-site scripting attacks on this host.

The remote host is running Tutos, an open source team organization software package written in PHP.

The remote version of this software is vulnerable to multiple input validation flaws that could allow an authenticated user to perform a cross-site scripting attack or a SQL injection against the remote service.

ID	Name	Product	Family	Severity
22846	Debian DSA-980-1 : tutos - several vulnerabilities	Nessus	Debian Local Security Checks	high
2308	Tutos Multiple Vulnerabilities	Nessus Network Monitor	CGI	high
14784	TUTOS < 1.2 Multiple Input Validation Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2004-2161

critical

Tenable Plugins

high

high

high