PT-2006-6759 · Coppermine · Coppermine Photo Gallery

Imei Addmimistrator · Publicado 2006-11-26 · Atualizado 2017-07-29 · CVE-2006-6123

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery (CPG) version 1.4.8 stable

Description The issue allows remote attackers to bypass XSS protection and set arbitrary variables via a query string. This is possible when register globals is enabled, causing variables to be defined in global space. The protection scheme unsets certain parameters, such as GET, REQUEST, or other critical parameters, which prevents the original variable from being detected.

Recommendations For Coppermine Photo Gallery (CPG) version 1.4.8 stable, consider disabling the register globals setting to prevent the exploitation of this issue. As a temporary workaround, restrict access to critical parameters, such as GET and REQUEST, to minimize the risk of arbitrary variable setting.

Correção

Identificadores relacionados

CVE-2006-6123

Produtos afetados

Coppermine Photo Gallery

Referências · 9

• http://secunia.com/advisories/20597 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27376 · Nota
• http://svn.sourceforge.net/viewvc/coppermine?view=rev&revision=3133 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2006-06/0482.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6123 · Nota
• http://osvdb.org/27618 · Nota
• http://myimei.com/security/2006-06-20/coppermine-148parameter-cleanup-system-bypassregistering-global-varables.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6123 · Nota de Segurança
• http://securityreason.com/securityalert/1914 · Nota