527 matches found
Information disclosure
themes/sample/theme.php in Coppermine Photo Gallery CPG 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...
CVE-2008-3481
themes/sample/theme.php in Coppermine Photo Gallery CPG 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...
CVE-2008-3481
themes/sample/theme.php in Coppermine Photo Gallery CPG 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...
CVE-2008-3481
The CVE-2008-3481 issue affects Coppermine Photo Gallery (CPG) 1.4.18 and earlier. A flaw in themes/sample/theme.php allows remote attackers to reveal the installation path via a crafted direct request, causing information disclosure. The CVSS vectors indicate Network access, low attack complexit...
Coppermine Photo Gallery < 1.4.19 data Cookie Local File Inclusion
Binary data 4613.prm...
Coppermine Photo Gallery lang参数本地文件包含漏洞
BUGTRAQ ID: 30480 Coppermine是用PHP编写的多用途集成Web图形库脚本。 Coppermine Photo Gallery没有正确地过滤对data cookie中编码的lang部分输入便用于包含文件，这允许远程攻击者通过目录遍历攻击和空字节包含本地资源的任意文件。成功攻击要求将字符编码设置为Unicode utf-8，而这是默认配置。 Coppermine Photo Gallery 1.4.18 Coppermine ---------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
Coppermine Photo Gallery <= 1.4.18 LFI / Remote Code Execution Exploit
No description provided by source. ?php / ---------------------------------------------------------------------- Coppermine Photo Gallery = 1.4.18 LFI / Remote Code Execution Exploit ---------------------------------------------------------------------- author...: EgiX mail.....:...
Coppermine Photo Gallery include/functions.inc.php _data Cookie lang Parameter Traversal Local File Inclusion
The version of Coppermine installed on the remote host fails to sanitize input to the 'lang' array element of its data cookie before using it in 'include/init.inc.php' to include PHP code. Provided the application's character set is set to 'utf-8', which it is by default, an unauthenticated, remo...
cpg-lfiexec.txt
authenticate; ... 301. // Process language selection if present in URI or in user profile or try 302. // autodetection if default charset is utf-8 303. if !empty$GET'lang' 304. 305. $USER'lang' = ereg"^a-z0-9-$", $GET'lang' ? $GET'lang' : $CONFIG'lang'; 306. 307. 308. if isset$USER'lang' &&...
Coppermine Photo Gallery <= 1.4.18 LFI / Remote Code Execution Exploit
Exploit for unknown platform in category web applications ====================================================================== Coppermine Photo Gallery authenticate; ... 301. // Process language selection if present in URI or in user profile or try 302. // autodetection if default charset is...
Coppermine Photo Gallery 1.4.18 - Local File Inclusion Remote Code Execution
Coppermine Photo Gallery 1.4.18 - Local File Inclusion Remote Code Execution authenticate; ... 301. // Process language selection if present in URI or in user profile or try 302. // autodetection if default charset is utf-8 303. if !empty$GET'lang' 304. 305. $USER'lang' = ereg"^a-z0-9-$",...
Coppermine Photo Gallery 1.4.18 - Local File Inclusion / Remote Code Execution
authenticate; ... 301. // Process language selection if present in URI or in user profile or try 302. // autodetection if default charset is utf-8 303. if !empty$GET'lang' 304. 305. $USER'lang' = ereg"^a-z0-9-$", $GET'lang' ? $GET'lang' : $CONFIG'lang'; 306. 307. 308. if isset$USER'lang' &&...
Coppermine <=1.4.16 [Content-type] SQL-injection Exploit
Coppermine =1.4.16 Content-type SQL-injection Exploit 1 Дата: Найдена: April 9, 2008 Пропатчена: April 11, 2008 http://forum.coppermine-gallery.net/index.php/topic,51787.0.html 2 Продукт: Coppermine Photo Gallery =1.4.16 3 Уязвимость: SQL-injection в Content-type при загрузке удаленных файлов...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Coppermine: SQL injection...
Coppermine <=1.4.17 SQL-inj Session Hijack Exploit
Coppermine =1.4.17 SQL-inj Session Hijack Exploit 1 Дата: Пропатчена: April 11, 2008 http://forum.coppermine-gallery.net/index.php/topic,51882.0.html 2 Продукт: Coppermine Photo Gallery =1.4.17 3 Уязвимость: SQL-инъекция в $COOKIE$this-clientid в /bridge/coppermine.inc.php Значение извлекается из...
Sql injection
SQL injection vulnerability in the session handling functionality in bridge/coppermine.inc.php in Coppermine Photo Gallery CPG 1.4.17 and earlier allows remote attackers to execute arbitrary SQL commands via an input field associated with the sessionid variable, as exploited in the wild in April...
CVE-2008-1840
SQL injection vulnerability in upload.php in Coppermine Photo Gallery CPG 1.4.16 and earlier allows remote authenticated users or user-assisted remote HTTP servers to execute arbitrary SQL commands via the Content-Type HTTP response header provided by the HTTP server that is used for an upload...
Sql injection
SQL injection vulnerability in upload.php in Coppermine Photo Gallery CPG 1.4.16 and earlier allows remote authenticated users or user-assisted remote HTTP servers to execute arbitrary SQL commands via the Content-Type HTTP response header provided by the HTTP server that is used for an upload...
CVE-2008-1841
SQL injection vulnerability in the session handling functionality in bridge/coppermine.inc.php in Coppermine Photo Gallery CPG 1.4.17 and earlier allows remote attackers to execute arbitrary SQL commands via an input field associated with the sessionid variable, as exploited in the wild in April...
CVE-2008-1840
CVE-2008-1840 affects Coppermine Photo Gallery (CPG) up to version 1.4.16. The vulnerability is an SQL injection in upload.php that can be exploited via the Content-Type HTTP header used during an upload. It can be exploited by remote authenticated users or user‑assisted remote HTTP servers to ex...