Coppermine Photo Gallery bridge/coppermine.inc.php Bridge Wizard Session Cookie SQL Injection

The version of Coppermine installed on the remote host fails to sanitize user-supplied input to the bridge wizard session cookie before using it in a database query in 'bridge/coppermine.inc.php'. Regardless of PHP's 'magicquotesgpc' setting, an attacker may be able to exploit this issue to...

FreeBSD : coppermine -- multiple vulnerabilities (9f581778-e3d4-11dc-bb89-000bcdc1757a)

Coppermine Security advisory The development team is releasing a security update for Coppermine in order to counter a recently discovered cross-site-scripting vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Coppermine Photo Gallery album Password Cookie SQL Injection

The version of Coppermine installed on the remote host fails to sanitize user-supplied input to the album password cookie before using it in a database query in the 'getprivatealbumset' function in 'include/functions.inc.php'. Regardless of PHP's 'magicquotesgpc' setting, an attacker may be able ...

waraxe-2008-SA066.txt

waraxe-2008-SA066 - Multiple Vulnerabilities in Coppermine 1.4.14 =============================================================================== Author: Janek Vind "waraxe" Date: 31. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-66.html Target software description:...

Sql injection

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery CPG before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 albumid, 2 startpic, and 3 numpics parameters to util.php; and 4 cidarray parameter to reviewcom.php...

Code injection

include/imageObjectIM.class.php in Coppermine Photo Gallery CPG before 1.4.15, when the ImageMagick picture processing method is configured, allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 quality, 2 angle, or 3 clipval parameter to picEditor.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in docs/showdoc.php in Coppermine Photo Gallery CPG before 1.4.15 allow remote attackers to inject arbitrary web script or HTML via the 1 h and 2 t parameters...

Immunity Canvas: COPPERMINE

Name| coppermine ---|--- CVE| CVE-2008-0506 Exploit Pack| CANVAS Description| coppermine Notes| CVE Name: CVE-2008-0506 VENDOR: Coppermine URL: http://www.milw0rm.com/exploits/5019 Repeatability: Infinite CVE Url: https://vulners.com/cve/CVE-2008-0506 CVSS: 6.8...

CVE-2008-0505

Multiple cross-site scripting XSS vulnerabilities in docs/showdoc.php in Coppermine Photo Gallery CPG before 1.4.15 allow remote attackers to inject arbitrary web script or HTML via the 1 h and 2 t parameters...

CVE-2008-0504

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery CPG before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 albumid, 2 startpic, and 3 numpics parameters to util.php; and 4 cidarray parameter to reviewcom.php...

CVE-2008-0505

Multiple cross-site scripting XSS vulnerabilities in docs/showdoc.php in Coppermine Photo Gallery CPG before 1.4.15 allow remote attackers to inject arbitrary web script or HTML via the 1 h and 2 t parameters...

CVE-2008-0504

Coppermine Photo Gallery (CPG) prior to version 1.4.15 contains multiple SQL injection flaws that can be triggered by an authenticated remote administrator via parameters (albumid, startpic, numpics) to util.php and cid_array to reviewcom.php. The underlying issue is insufficient input validation...

CVE-2008-0506

CVE-2008-0506 affects Coppermine Photo Gallery (CPG) implemention, specifically picEditor.php when using ImageMagick. The vulnerability arises because the (quality, angle, clipval) parameters are not properly escaped before passing to PHP exec, allowing remote command execution via shell metachar...

CVE-2008-0505

CVE-2008-0505 affects Coppermine Photo Gallery: multiple XSS in docs/showdoc.php before 1.4.15. Attacks inject arbitrary script/HTML via the h and t parameters. Impact is user-visible content tampering; no patch details are provided in the supplied documents. Affected version range and remediatio...

CVE-2008-0504

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery CPG before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 albumid, 2 startpic, and 3 numpics parameters to util.php; and 4 cidarray parameter to reviewcom.php...

CVE-2008-0504: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery CPG before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 albumid, 2 startpic, and 3 numpics parameters to util.php; and 4 cidarray parameter to reviewcom.php...

waraxe-2008-SA065.txt

waraxe-2008-SA065 - Remote Shell Command Execution in Coppermine 1.4.14 =============================================================================== Author: Janek Vind "waraxe" Date: 30. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-65.html Target software descriptio...

Coppermine Photo Gallery 1.4.14 Remote Command Execution Exploit

No description provided by source. waraxe-2008-SA065 - Remote Shell Command Execution in Coppermine 1.4.14 =============================================================================== Author: Janek Vind "waraxe" Date: 30. January 2008 Location: Estonia, Tartu Web:...

CVE-2008-0505: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in docs/showdoc.php in Coppermine Photo Gallery CPG before 1.4.15 allow remote attackers to inject arbitrary web script or HTML via the 1 h and 2 t parameters...

[waraxe-2008-SA#066] - Multiple Vulnerabilities in Coppermine 1.4.14

waraxe-2008-SA066 - Multiple Vulnerabilities in Coppermine 1.4.14 =============================================================================== Author: Janek Vind "waraxe" Date: 31. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-66.html Target software description:...