coppermine -- "file" Local File Inclusion Vulnerability

Secunia reports: Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious people to disclose sensitive information. Input passed to the "file" parameter in "index.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary...

Coppermine Photo Gallery index.php file Parameter Local File Inclusion

The version of Coppermine Gallery installed on the remote host fails to properly sanitize input to the 'file' parameter of the 'index.php' script before using it in a PHP 'includeonce' function. Regardless of PHP's 'registerglobals' setting, an unauthenticated attacker may be able to exploit this...

- PHPGraphy <= 0.9.11 "editwelcome" unauthorized access / cross site scripting -

PHPGraphy = 0.9.11 "editwelcome" unauthorized access / cross site scripting - -------------------------------- software site: http://phpgraphy.sourceforge.net/ description: "Full featured photo gallery PHP script - Light, fast and easy to install" vulnerable code index.php near line 503-10:...

[KAPDA]CopperminePhotoGallery1.4.4~ PluginInclusionSystem(index.php)~ RemoteFileInclusion attack

ORIGINAL ADVISORY: http://myimei.com/security/2006-04-14/copperminephotogallery144-plugininclusionsystemindexphp-remotefileinclusion-attack.html ——————-Summary—————- Software: CPG Coppermine Photo Gallery Sowtware’s Web Site: http://coppermine.sourceforge.net/ Versions: 1.4.4.stable Class: Remote...

CVE-2006-1667

Summary: CVE-2006-1667 affects Eric Gerdes Crafty Syntax Image Gallery (CSIG) up to version 3.1g. The vulnerability is a SQL injection in slides.php caused when the variable $projectid is less than 1, which prevents the limitquery_s parameter from being set. This enables remote authenticated user...

[Full-disclosure] [SECURITY] [DSA 989-1] New zoph packages fix SQL injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 989-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 9th, 2006 http://www.debian.org/security/faq -...

DSA-989-1 zoph - SQL injection

Bulletin has no description...

CVE-2006-0873

Absolute path traversal vulnerability in docs/showdocs.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via the f parameter, and possibly remote files using UNC share pathnames...

CVE-2006-0872

Directory traversal vulnerability in init.inc.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via a .. dot dot sequence and trailing NULL %00 byte in the lang parameter...

Directory traversal

Directory traversal vulnerability in init.inc.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via a .. dot dot sequence and trailing NULL %00 byte in the lang parameter...

Path traversal

Absolute path traversal vulnerability in docs/showdocs.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via the f parameter, and possibly remote files using UNC share pathnames...

CVE-2006-0872

Directory traversal vulnerability in init.inc.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via a .. dot dot sequence and trailing NULL %00 byte in the lang parameter...

CVE-2006-0872

CVE-2006-0872 describes a directory traversal vulnerability in Coppermine Photo Gallery

CVE-2006-0873

CVE-2006-0873 affects Coppermine Photo Gallery (docs/showdoc.php, f parameter). It is an absolute path traversal / local file inclusion vulnerability allowing arbitrary file inclusion, potentially from Windows UNC shares. Affected: Coppermine Photo Gallery 1.4.3 and earlier. Root cause: unsanitiz...

cpg_143_incl_xpl

this works regardless of any php.ini settings, you need a normal user account with upload rights in personal albums and at least one album usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: "The direct and the indirect lead on to each other in turn. It is like moving in a...

Coppermine Photo Gallery <=1.4.3 remote code execution

Coppermine Photo Gallery = 1.4.3 arbitrary local/remote inclusion: --------- - 18/02/2006 5.09.55 ----------------------------------------------------------- -------------------------------------------------------------------------------- software: site: http://coppermine-gallery.net/index.php...

coppermine -- File Inclusion Vulnerabilities

Secunia reports: Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious people and by malicious users to compromise a vulnerable system. 1 Input passed to the "lang" parameter in include/init.inc.php isn't properly verified, before it is used to include files. This can...

Coppermine Photo Gallery 1.4.3 - Remote Command Execution

Coppermine Photo Gallery 1.4.3 - Remote Command Execution this works regardless of any php.ini settings, you need a normal user account with upload rights in personal albums and at least one album usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: "The direct and the indirect...

Coppermine Photo Gallery <= 1.4.3 Remote Commands Execution Exploit

No description provided by source. ?php ---cpg143inclxpl.php 15.38 04/12/2005 Coppermine Photo Gallery = 1.4.3 remote commands execution coded by rgod site: http://retrogod.altervista.org - this works regardless of any php.ini settings, you need a normal user account with upload rights in persona...

Coppermine Photo Gallery 1.4.3 - Remote Command Execution

this works regardless of any php.ini settings, you need a normal user account with upload rights in personal albums and at least one album usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: "The direct and the indirect lead on to each other in turn. It is like moving in a...