TUTOS Input Validation Holes in 'file_overview' and 'app_new' Permit SQL Injection and Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1011363
|
|
SecurityTracker URL: http://securitytracker.com/id?1011363
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Sep 20 2004
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 1.1 and prior versions
|
Description: Several input validation vulnerabilities were reported in TUTOS. A remote user can inject SQL commands. A remote user can conduct cross-site scripting attacks.
Joxean Koret reported that the '/file/file_overview.php' script does not properly validate user-supplied input in the 'link_id' parameter.
A demonstration exploit URL is provided:
http://[target]/file/file_overview.php?link_id=1005'asdf
It is also reported that
the 'app_new.php' script does not filter HTML code from user-supplied input in the 't' variable. A remote user can create a specially
crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser.
The code will originate from the site running the TUTOS software and will run in the security context of that site. As a result,
the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site,
access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A
demonstration exploit URL is provided:
http://[target]/app_new.php?t=200408240<script>alert(document.cookie)</script>
It
is also reported that the search field does not filter HTML code from user-supplied input.
|
Impact: A remote user can inject SQL commands to be executed by the underlying database.
A remote user can access the target user's cookies
(including authentication cookies), if any, associated with the site running the TUTOS software, access data recently submitted
by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution: The vendor has released a fixed version (1.2), available at:
http://www.tutos.org/homepage/download.html
|
Vendor URL: www.tutos.org/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: Joxean Koret <joxeankoret@yahoo.es>
|
Message History:
None.
|
Source Message Contents
|
Date: 18 Sep 2004 20:46:09 -0000
From: Joxean Koret <joxeankoret@yahoo.es>
Subject: Vulnerabilities in TUTOS
|
---------------------------------------------------------------------------
Multiple Vulnerabilities in TUTOS
---------------------------------------------------------------------------
Author: Jose Antonio Coret (Joxean Koret)
Date: 2004
Location: Basque Country
---------------------------------------------------------------------------
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
TUTOS 1.1 (2004-04-14) and prior versions
TUTOS is a tool to manage the the
organizational needs of small groups, teams,
departments ... To do this it provides some
web-based tools.
Web : http://www.tutos.org
---------------------------------------------------------------------------
Vulnerabilities:
~~~~~~~~~~~~~~~~
A. SQL Injection.
You can insert sql commands in
the /file/file_overview.php by inserting
it in the link_id parameter.
To try this :
http://<site-with-tutos>/file/file_overview.php?link_id=1005'asdf
B. Cross Site Scripting
B1. In the address book the search field is
vulnerable to XSS. You can
try it by simply :
1.- Logging into TUTOS
2.- Click on the Address Module
3.- In the search field insert the following
data :
"><script>alert(document.cookie)</script>
4.- You will see your cookie
B2. In the app_new.php script there is also an
other xss vulnerability.
Try the following URL :
http://<site-with-tutos>/app_new.php?t=200408240<script>alert(document.co
okie)</script>
The fix:
~~~~~~~~
The author has fixed all the problems. As a new
relase wil be available soon
this release will have all the fixes included.
(Currently on the way to CVS).
Disclaimer:
~~~~~~~~~~~
The information in this advisory and any of its
demonstrations is provided
"as is" without any warranty of any kind.
I am not liable for any direct or indirect damages
caused as a result of
using the information or demonstrations
provided in any part of this
advisory.
---------------------------------------------------------------------------
Contact:
~~~~~~~~
Joxean Koret at
joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<
dot>>>>>es
|
|
