Tutos 1.1 - File_New Arbitrary File Upload

Author: François SORIN
type: webapps
platform: php
port: 0
date_added: 2003-06-20
date_updated: 2012-11-19
verified: 1
codes: CVE-2003-0482;OSVDB-10163
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/8012/info

It has been reported that Tutos does not properly handle input to the file_new script. Because of this, an attacker may be able to upload arbitrary files to a vulnerable site.

We can upload via http://www.example.com/tutos/file/file_new.php?link_id=1065

The path is http://www.example.com/tutos/repository/[project number]/[file
number]/FILE