Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2004-2161: TUTOS 1.1 lets attackers run unauthorized database commands
CVE-2004-2161 · published 21 years ago
Summary
The web page file_overview.php in TUTOS 1.1 can be tricked into executing harmful database instructions through a specially crafted link. This could let a remote attacker read, change, or delete your stored data. Install any available security update from the vendor or upgrade to a newer version that fixes the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tutos | tutos |
1.1_2004-04-14 cpe:2.3:a:tutos:tutos:1.1_2004-04-14:*:*:*:*:*:*:* |
Original advisory text
SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.
SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.
References
- http://cvs.sourceforge.net/viewcvs.py/tutos/tutos/php/file/file_overview.php?r1=...
- http://secunia.com/advisories/12606/ Exploit Patch Vendor Advisory
- http://secunia.com/advisories/18954
- http://securitytracker.com/id?1011363
- http://www.debian.org/security/2006/dsa-980
- http://www.osvdb.org/10164
- http://www.securityfocus.com/archive/1/375757 Exploit Vendor Advisory
- http://www.securityfocus.com/bid/11221 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17444
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Timeline
Published31 Dec 2004
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2004-2161 · NVD
Track software like this
Free during beta