PT-2025-51286 · Unknown · Coppermine-Gallery

Mirabbas Ağalarov · CVE-2023-53868 · Publicado 2025-12-15 · Atualizado 2025-12-21

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coppermine Gallery version 1.6.25

Description Coppermine Gallery version 1.6.25 has a remote code execution issue. Authenticated attackers can upload malicious PHP files through the plugin manager. Attackers can upload a zipped PHP file containing system commands to the plugin directory and then execute arbitrary code by accessing the uploaded plugin script. The vulnerability affects systems where an authenticated user has the ability to manage plugins.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the plugin manager functionality to prevent unauthorized file uploads.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-53868

Produtos afetados

Coppermine-Gallery

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53868.json · Exploit
• 🔥 https://exploit-db.com/exploits/51738 · Exploit
• https://twitter.com/VulmonFeeds/status/2000761145028747645 · Publicação no Twitter
• https://web.archive.org/web/20240101151648/https://coppermine-gallery.net · Nota
• https://osv.dev/vulnerability/CVE-2023-53868 · Aviso do Fabricante
• https://t.me/cveNotify/146261 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-53868 · Nota de Segurança
• https://vulncheck.com/advisories/coppermine-gallery-remote-code-execution-via-plugin-upload · Nota
• https://twitter.com/CVEnew/status/2002857380695146962 · Publicação no Twitter