PT-2004-2882 · Coppermine · Coppermine Photo Gallery

Janek Vind + 1 · Publicado 2004-04-04 · Atualizado 2017-07-11 · CVE-2004-1986

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions 1.2.0 RC4 through 1.2.2b

Description The issue allows remote attackers with administrative privileges to read arbitrary files. This is achieved by exploiting a directory traversal vulnerability in the modules.php file, specifically by using a .. (dot dot) in the startdir parameter.

Recommendations For Coppermine Photo Gallery versions 1.2.0 RC4 through 1.2.2b, consider restricting access to the modules.php file or avoid using the startdir parameter until a fix is available. As a temporary workaround, restrict administrative privileges to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2004-1986

Produtos afetados

Coppermine Photo Gallery

Referências · 10

• 🔥 https://exploit-db.com/exploits/24073 · Exploit
• 🔥 http://waraxe.us/index.php?modname=sa&id=26 · Exploit
• 🔥 http://securityfocus.com/bid/10253 · Exploit
• 🔥 http://secunia.com/advisories/11524 · Exploit
• http://marc.info/?l=bugtraq&m=108360247732014&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1986 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1986 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16042 · Nota
• http://osvdb.org/5758 · Nota
• http://securitytracker.com/id?1010001 · Nota