Vulnerabilities > CVE-2004-2161 - Remote Input Validation vulnerability in Tutos 1.120040414

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
tutos
nessus
exploit available
NVD
Published: 2004-12-31
Updated: 2017-07-11

Summary

SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.

Vulnerable Configurations

Part Description Count
Application
Tutos
1

Exploit-Db

descriptionTUTOS file_overview.php link_id Parameter SQL Injection. CVE-2004-2161. Webapps exploit for php platform
idEDB-ID:24616
last seen2016-02-02
modified2004-09-20
published2004-09-20
reporterJoxean Koret
sourcehttps://www.exploit-db.com/download/24616/
titleTUTOS file_overview.php link_id Parameter SQL Injection

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-980.NASL
    descriptionJoxean Koret discovered several security problems in tutos, a web-based team organization software. The Common Vulnerabilities and Exposures Project identifies the following problems : - CVE-2004-2161 A SQL injection vulnerability allows the execution of SQL commands through the link_id parameter in file_overview.php. - CVE-2004-2162 Cross-Site-Scripting vulnerabilities in the search function of the address book and in app_new.php allow the execution of web script code.
    last seen2020-06-01
    modified2020-06-02
    plugin id22846
    published2006-10-14
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/22846
    titleDebian DSA-980-1 : tutos - several vulnerabilities
  • NASL familyCGI abuses
    NASL idTUTOS_SQL_XSS.NASL
    descriptionThe remote host is running Tutos, an open source team organization software package written in PHP. The remote version of this software is vulnerable to multiple input validation flaws that could allow an authenticated user to perform a cross-site scripting attack or a SQL injection against the remote service.
    last seen2020-06-01
    modified2020-06-02
    plugin id14784
    published2004-09-21
    reporterThis script is Copyright (C) 2004-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/14784
    titleTUTOS < 1.2 Multiple Input Validation Vulnerabilities

References