Tutos 1.1 - File_New Arbitrary File Upload

Author: François SORIN
type: webapps
platform: php
port: 
date_added: 2003-06-20 
date_updated: 2012-11-19 
verified: 1 
codes: CVE-2003-0482;OSVDB-10163 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/8012/info

It has been reported that Tutos does not properly handle input to the file_new script. Because of this, an attacker may be able to upload arbitrary files to a vulnerable site.

We can upload via http://www.example.com/tutos/file/file_new.php?link_id=1065

The path is http://www.example.com/tutos/repository/[project number]/[file
number]/FILE