PT-2006-6759 · Coppermine · Coppermine Photo Gallery

Imei Addmimistrator · Published 2006-11-26 · Updated 2017-07-29 · CVE-2006-6123

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery (CPG) version 1.4.8 stable

Description The issue allows remote attackers to bypass XSS protection and set arbitrary variables via a query string. This is possible when register globals is enabled, causing variables to be defined in global space. The protection scheme unsets certain parameters, such as GET, REQUEST, or other critical parameters, which prevents the original variable from being detected.

Recommendations For Coppermine Photo Gallery (CPG) version 1.4.8 stable, consider disabling the register globals setting to prevent the exploitation of this issue. As a temporary workaround, restrict access to critical parameters, such as GET and REQUEST, to minimize the risk of arbitrary variable setting.

Fix

Related Identifiers

CVE-2006-6123

Affected Products

Coppermine Photo Gallery

References · 9

• http://secunia.com/advisories/20597 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6123 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27376 · Note
• http://svn.sourceforge.net/viewvc/coppermine?view=rev&revision=3133 · Note
• http://archives.neohapsis.com/archives/bugtraq/2006-06/0482.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6123 · Note
• http://osvdb.org/27618 · Note
• http://myimei.com/security/2006-06-20/coppermine-148parameter-cleanup-system-bypassregistering-global-varables.html · Note
• http://securityreason.com/securityalert/1914 · Note