SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   TUTOS Vendors:   tutos.org
TUTOS Input Validation Holes in 'file_overview' and 'app_new' Permit SQL Injection and Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1011363
SecurityTracker URL:  http://securitytracker.com/id/1011363
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 20 2004
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.1 and prior versions
Description:   Several input validation vulnerabilities were reported in TUTOS. A remote user can inject SQL commands. A remote user can conduct cross-site scripting attacks.

Joxean Koret reported that the '/file/file_overview.php' script does not properly validate user-supplied input in the 'link_id' parameter. A demonstration exploit URL is provided:

http://[target]/file/file_overview.php?link_id=1005'asdf

It is also reported that the 'app_new.php' script does not filter HTML code from user-supplied input in the 't' variable. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the TUTOS software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A demonstration exploit URL is provided:

http://[target]/app_new.php?t=200408240<script>alert(document.cookie)</script>

It is also reported that the search field does not filter HTML code from user-supplied input.

Impact:   A remote user can inject SQL commands to be executed by the underlying database.

A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the TUTOS software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

Solution:   The vendor has released a fixed version (1.2), available at:

http://www.tutos.org/homepage/download.html

Vendor URL:  www.tutos.org/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  Vulnerabilities in TUTOS




--------------------------------------------------------------------------- 
              Multiple Vulnerabilities in TUTOS 
--------------------------------------------------------------------------- 
 
Author: Jose Antonio Coret (Joxean Koret) 
Date: 2004  
Location: Basque Country 
 
--------------------------------------------------------------------------- 
 
Affected software description: 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
 
TUTOS 1.1 (2004-04-14) and prior versions 
 
TUTOS is a tool to manage the the 
organizational needs of small groups, teams, 
departments ... To do this it provides some 
web-based tools. 
 
Web : http://www.tutos.org 
 
--------------------------------------------------------------------------- 
 
Vulnerabilities: 
~~~~~~~~~~~~~~~~ 
 
A. SQL Injection. 
 
        You can insert sql commands in 
the /file/file_overview.php by inserting 
it in the link_id parameter.  
 
To try this :  
 
http://<site-with-tutos>/file/file_overview.php?link_id=1005'asdf 
 
B. Cross Site Scripting 
 
B1. In the address book the search field is 
vulnerable to XSS. You can 
try it by simply :  
 
        1.- Logging into TUTOS 
        2.- Click on the Address Module 
        3.- In the search field insert the following 
data :  
 
        ">&lt;script&gt;alert(document.cookie)&lt;/script&gt; 
 
        4.- You will see your cookie 
 
 
B2. In the app_new.php script there is also an 
other xss vulnerability. 
Try the following URL :  
 
        http://<site-with-tutos>/app_new.php?t=200408240&lt;script&gt;alert(document.cookie)&lt;/script&gt; 
 
The fix: 
~~~~~~~~ 
 
The author has fixed all the problems. As a new 
relase wil be available soon 
this release will have all the fixes included. 
(Currently on the way to CVS). 
 
Disclaimer: 
~~~~~~~~~~~ 
 
The information in this advisory and any of its 
demonstrations is provided 
"as is" without any warranty of any kind. 
 
I am not liable for any direct or indirect damages 
caused as a result of 
using the information or demonstrations 
provided in any part of this 
advisory.  
 
--------------------------------------------------------------------------- 
 
Contact: 
~~~~~~~~ 
 
	Joxean Koret at 
joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es 
 
 
 

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC