Secunia

Several vulnerabilities have been reported in TUTOS, which can be exploited by malicious people to conduct Cross-Site Scripting attacks against users and upload malicious files.

TUTOS doesn't validate user input supplied to various parameters. This can be exploited to execute arbitrary script code in a user's browser session by tricking the user into using a malicious link or visiting a malicious website.

Successful exploitation can result in disclosure of various information (eg. cookie-based authentication information) associated with the site running TUTOS or inclusion of malicious content, which the user thinks is part of the real website.

Example:
http://[victim]/tutos/file/file_select.php?msg=<hostile_code>

It has been reported that a malicious user also may be able to upload arbitrary files to the system and then execute them.

Example:
http://[victim]/tutos/file/file_new.php?link_id=1065 (upload file)
http://[victim]/tutos/repository/[project_number]/[file_number]/FILE (execute file)

Solution
Reportedly, an updated version (BRANCH-1-1) is available via CVS.
Further details available in Customer Area

Provided and/or discovered by
François SORIN

Original Advisory
http://www.security-corporation.com/articles-20030624-000.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area