Ravens PHP Scripts

Coppermine Photo Gallery *bridge/coppermine.inc.php* SQL Injection
Date: Monday, April 14, 2008 @ 15:48:05 CEST
Topic: Security


VERIFY ADVISORY: http://secunia.com/advisories/29741/

CRITICAL: Moderately critical

IMPACT: Manipulation of data

SOFTWARE: Coppermine Photo Gallery 1.x http://secunia.com/product/1427/

DESCRIPTION: A vulnerability has been reported in Coppermine Photo Gallery, which can be exploited by malicious people to conduct SQL injection attacks. The vulnerability is reported in version 1.4.17. Prior versions may also be affected.

Input passed to unspecified cookies in bridge/coppermine.inc.php is not properly sanitized before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

SOLUTION: Update to version 1.4.18.

PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.

ORIGINAL ADVISORY: http://forum.coppermine-gallery.net/index.php/topic,51882.0.html

This article comes from Ravens PHP Scripts

The URL for this story is: