PT-2007-1607 · Coppermine · Coppermine Photo Gallery

Darkfig · Publicado 2007-01-09 · Atualizado 2018-10-16 · CVE-2007-0122

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions 1.4.10 and earlier

Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This can be achieved via the cat parameter to "albmgr.php", and possibly the gid parameter to "usermgr.php", the start parameter to "db ecard.php", and the albumid parameter to unspecified files. The filename to title and del titles functions are also related to this issue.

Recommendations For Coppermine Photo Gallery versions 1.4.10 and earlier, consider disabling access to the "albmgr.php" and "usermgr.php" files until a patch is available. Restrict the use of the cat, gid, start, and albumid parameters in the affected API endpoints to minimize the risk of exploitation. Avoid using the filename to title and del titles functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2007-0122

Produtos afetados

Coppermine Photo Gallery

Referências · 14

• 🔥 http://securityfocus.com/bid/21894 · Exploit
• 🔥 https://exploit-db.com/exploits/3085 · Exploit
• 🔥 https://exploit-db.com/exploits/29397 · Exploit
• http://osvdb.org/35853 · Nota
• http://osvdb.org/35852 · Nota
• http://osvdb.org/35855 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0122 · Nota
• http://secunia.com/advisories/25846 · Nota
• http://securityreason.com/securityalert/2123 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0122 · Nota de Segurança
• http://acid-root.new.fr/poc/19070104.txt · Nota
• http://securityfocus.com/archive/1/456051/100/0/threaded · Nota
• http://osvdb.org/35856 · Nota
• http://osvdb.org/35854 · Nota