BID:14625

Coppermine Displayimage.PHP Script Injection Vulnerability

Info

Coppermine Displayimage.PHP Script Injection Vulnerability

Bugtraq ID:	14625
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 22 2005 12:00AM
Updated:	Aug 22 2005 12:00AM
Credit:	The vendor has disclosed this vulnerability.
Vulnerable:	Coppermine Photo Gallery 1.3.3 Coppermine Photo Gallery 1.3.2 Coppermine Photo Gallery 1.3 Coppermine Photo Gallery 1.2.2 b Coppermine Photo Gallery 1.2.1 Coppermine Photo Gallery 1.2 Coppermine Photo Gallery 1.1 beta 2 Coppermine Photo Gallery 1.1 .0 Coppermine Photo Gallery 1.0 RC3

Not Vulnerable:	Coppermine Photo Gallery 1.3.4

Discussion

Coppermine Displayimage.PHP Script Injection Vulnerability

Coppermine is prone to a script injection vulnerability. This is due to a lack of proper sanitization of user-supplied input.

A malicious user may cause arbitrary script code to be executed in the Web browser context of an unsuspecting victim. This may lead to the theft of cookie-based authentication credentials in the context of the victim's browser application.

Exploit / POC

Coppermine Displayimage.PHP Script Injection Vulnerability

No exploit is required.

Solution / Fix

Coppermine Displayimage.PHP Script Injection Vulnerability

Solution:
The vendor has released version 1.3.4 to address this issue.

Coppermine Photo Gallery 1.0 RC3