PT-2007-2535 · Coppermine · Coppermine Photo Gallery

Rst/Ghc · Published 2007-02-26 · Updated 2018-10-16 · CVE-2007-1107

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions 1.3.x through 1.4.x

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via a cpg131 fav cookie in the thumbnails.php file. The estimated number of potentially affected devices and details about real-world incidents are not specified.

Recommendations For Coppermine Photo Gallery versions 1.3.x through 1.4.x, consider restricting access to the thumbnails.php file until a fix is available. As a temporary workaround, avoid using the cpg131 fav cookie in the affected API endpoint.

Exploit

Fix

Related Identifiers

CVE-2007-1107

Affected Products

Coppermine Photo Gallery

References · 12

• 🔥 https://exploit-db.com/exploits/4961 · Exploit
• 🔥 https://exploit-db.com/exploits/4950 · Exploit
• 🔥 https://exploit-db.com/exploits/3371 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1107 · Security Note
• http://osvdb.org/33133 · Note
• http://securityfocus.com/bid/22709 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32688 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1107 · Note
• http://securityfocus.com/bid/27372 · Note
• http://securityreason.com/securityalert/2297 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39806 · Note
• http://securityfocus.com/archive/1/461158/100/0/threaded · Note