Coppermine Photo Gallery <= 1.3.2 File Retrieval SQL Injection Exploit

No description provided by source. tested and approved /str0ke CPG Exploit File Retrieval by SQL Injection. By Default this exploit get the config.inc.php file which contains the db user/pass If you want to get another file you need to have the good cookie you can use this phpscript to get good...

Multiple PHP Images Galleries EXIF Metadata XSS Vulnerabilities

Multiple PHP Images Galleries EXIF Metadata XSS Vulnerabilities Summary : A large majority of PHP Images Gallery Technologies now handle the Exchangeable Image File EXIF header of jpeg files. The Exchangeable Image File EXIF format is an international specification that lets imaging companies...

Coppermine Photo Gallery EXIF Data XSS

According to its banner, the version of Coppermine Gallery installed on the remote host is prone to cross-site scripting attacks because it does not sanitize malicious EXIF data stored in image files. Using a specially crafted image file, an attacker can exploit this flaw to cause arbitrary HTML...

CVE-2005-2676

Cross-site scripting XSS vulnerability in displayimage.php in Coppermine Photo Gallery before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via EXIF data...

CVE-2005-2676

Cross-site scripting XSS vulnerability in displayimage.php in Coppermine Photo Gallery before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via EXIF data...

CVE-2005-2676

The CVE-2005-2676 entry concerns Coppermine Photo Gallery prior to version 1.3.4, where displayimage.php is vulnerable to cross-site scripting via crafted EXIF data. The vulnerability allows an attacker-supplied EXIF payload to be reflected into the HTML/JS context, enabling arbitrary script exec...

CVE-2005-2676: Undefined Security Weakness

Cross-site scripting XSS vulnerability in displayimage.php in Coppermine Photo Gallery before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via EXIF data...

Coppermine Gallery < 1.3.4 displayimage.php HTML Injection (deprecated)

Binary data 3178.prm...

FreeBSD : coppermine -- IP spoofing and XSS vulnerability (756db070-b9d4-11d9-ae81-000ae42e9b93)

GHC team reports about coppermine The lack of sanitizing of user defined variables may result in undesirable consequences such as IP spoofing or XSS attack. Generally users of Coppermine Gallery can post comments. Remote address & x-forwarded-for variables are logged for admin's eyes...

waraxe-2005-SA042.txt

================================================================================ waraxe-2005-SA042 ================================================================================ Multiple vulnerabilities in Coppermine Photo Gallery 1.3.2...

CVE-2004-1984

The CVE concerns Coppermine Photo Gallery versions 1.2.2b and 1.2.0 RC4. Affected files (phpinfo.php, addpic.php, config.php, db_input.php, displayecard.php, ecard.php, crop.inc.php) can disclose the full server path via a PHP error message when accessed directly, leaking information about the in...

CVE-2004-1989

The CVE-2004-1989 entry affects Coppermine Photo Gallery 1.2.2b, where a vulnerability in theme.php allows a remote attacker to execute arbitrary PHP code by altering THEME_DIR to reference a URL containing user_list_info_box.inc. This is a PHP remote file inclusion flaw with network access, no a...

CVE-2004-1988

PHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary PHP code by modifying the CPGMDIR to reference a URL on a remote web server that contains functions.inc.php...

CVE-2004-1985

Cross-site scripting XSS vulnerability in menu.inc.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to inject arbitrary HTML or web script via the CPGURL parameter...

CVE-2004-1986

CVE-2004-1986 describes a directory traversal vulnerability in Coppermine Photo Gallery, specifically in modules.php. The affected versions are Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4, where remote attackers with administrative privileges can read arbitrary files by injecting a '..' sequenc...

CVE-2004-1984

Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers to obtain sensitive information via a direct HTTP request to 1 phpinfo.php, 2 addpic.php, 3 config.php, 4 dbinput.php, 5 displayecard.php, 6 ecard.php, 7 crop.inc.php, which reveal the full path in a PHP error message...

CVE-2004-1989

PHP remote file inclusion vulnerability in theme.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to execute arbitrary PHP code by modifying the THEMEDIR parameter to reference a URL on a remote web server that contains userlistinfobox.inc...

CVE-2004-1988

The CVE-2004-1988 entry documents a PHP remote file inclusion in Coppermine Photo Gallery 1.2.0 RC4. The vulnerability arises when the CPG_M_DIR setting is manipulated to reference a URL on a remote server that serves functions.inc.php, allowing an attacker to execute arbitrary PHP code on the af...

CVE-2004-1985

CVE-2004-1985 describes a cross-site scripting (XSS) vulnerability in Coppermine Photo Gallery 1.2.2b, specifically in menu.inc.php via the CPG_URL parameter. The issue allows remote attackers to inject arbitrary HTML or script. The provided sources (NVD/CVELIST) confirm the affected product/vers...

CVE-2004-1987

The CVE-2004-1987 vulnerability affects Coppermine Photo Gallery versions 1.2.2b and 1.2.0 RC4. It permits remote attackers with administrative privileges to execute arbitrary commands through shell metacharacters in the configuration parameters $CONFIG['impath'] or $CONFIG['jpeg_qual']. The conn...