PT-2004-2882 · Coppermine · Coppermine Photo Gallery

Janek Vind + 1 · Published 2004-04-04 · Updated 2017-07-11 · CVE-2004-1986

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions 1.2.0 RC4 through 1.2.2b

Description The issue allows remote attackers with administrative privileges to read arbitrary files. This is achieved by exploiting a directory traversal vulnerability in the modules.php file, specifically by using a .. (dot dot) in the startdir parameter.

Recommendations For Coppermine Photo Gallery versions 1.2.0 RC4 through 1.2.2b, consider restricting access to the modules.php file or avoid using the startdir parameter until a fix is available. As a temporary workaround, restrict administrative privileges to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-1986

Affected Products

Coppermine Photo Gallery

References · 10

• 🔥 https://exploit-db.com/exploits/24073 · Exploit
• 🔥 http://waraxe.us/index.php?modname=sa&id=26 · Exploit
• 🔥 http://securityfocus.com/bid/10253 · Exploit
• 🔥 http://secunia.com/advisories/11524 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1986 · Security Note
• http://marc.info/?l=bugtraq&m=108360247732014&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1986 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16042 · Note
• http://osvdb.org/5758 · Note
• http://securitytracker.com/id?1010001 · Note