PT-2004-2881 · Coppermine · Coppermine Photo Gallery

Published 2004-04-30 · Updated 2017-07-11 · CVE-2004-1985

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery version 1.2.2b

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary HTML or web script. This is achieved via the CPG URL parameter in the menu.inc.php file.

Recommendations For Coppermine Photo Gallery version 1.2.2b, as a temporary workaround, consider restricting access to the menu.inc.php file or validating and sanitizing the CPG URL parameter to prevent malicious input.

Exploit

Fix

Related Identifiers

CVE-2004-1985

Affected Products

Coppermine Photo Gallery

References · 9

• 🔥 https://exploit-db.com/exploits/24072 · Exploit
• 🔥 http://securityfocus.com/bid/10253 · Exploit
• http://secunia.com/advisories/11524 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1985 · Security Note
• http://marc.info/?l=bugtraq&m=108360247732014&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1985 · Note
• http://waraxe.us/index.php?modname=sa&id=26 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16040 · Note
• http://osvdb.org/5757 · Note