PT-2012-3383 · Coppermine · Coppermine Photo Gallery

Janek Vind + 1 · Published 2012-09-04 · Updated 2012-09-05 · CVE-2012-1614

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions prior to 1.5.20

Description The issue allows remote attackers to obtain sensitive information via various invalid parameters to different scripts, which reveals the installation path in an error message. This can be achieved by making a direct request to "plugins/visiblehookpoints/index.php", or by providing an invalid page or cat parameter to "thumbnails.php", an invalid page parameter to "usermgr.php", or an invalid newer than or older than parameter to "search.inc.php".

Recommendations For Coppermine Photo Gallery versions prior to 1.5.20, update to version 1.5.20 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-1614

Affected Products

Coppermine Photo Gallery

References · 17

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-03/0167.html · Exploit
• 🔥 http://osvdb.org/80732 · Exploit
• 🔥 http://waraxe.us/advisory-81.html · Exploit
• 🔥 http://osvdb.org/80734 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2012/04/03/6 · Exploit
• 🔥 http://exploit-db.com/exploits/18680 · Exploit
• 🔥 https://exploit-db.com/exploits/18680 · Exploit
• 🔥 http://osvdb.org/80733 · Exploit
• 🔥 http://osvdb.org/80735 · Exploit
• 🔥 http://packetstormsecurity.org/files/111369/Coppermine-1.5.18-Cross-Site-Scripting-Path-Disclosure.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1614 · Security Note
• http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.6.x/edit_one_pic.php?r1=8348&r2=8354 · Patch
• http://openwall.com/lists/oss-security/2012/03/30/5 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1614 · Note
• http://openwall.com/lists/oss-security/2012/03/30/6 · Note