CVE-2004-2162

TUTOS 1.1 - Cross-Site Scripting via Search Field or t Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-2162. PoCs published by Joxean Koret.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Tutos 1.1.2004-04-14 by injecting a script tag into the 't' parameter of app_new.php. The PoC triggers an alert box displaying the user's cookies, confirming the vulnerability.

Description

Multiple cross-site scripting (XSS) vulnerabilities in TUTOS 1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the search field of the Address Module or (2) the t parameter to app_new.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Joxean Koret · textwebappsphp

https://www.exploit-db.com/exploits/24617

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Tutos 1.1.2004-04-14 by injecting a script tag into the 't' parameter of app_new.php. The PoC triggers an alert box displaying the user's cookies, confirming the vulnerability.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Tutos 1.1.2004-04-14

No auth needed

Prerequisites: Access to the vulnerable web application

MITRE ATT&CK