Ravens PHP Scripts - Coppermine Photo Gallery *bridge/coppermine.inc.php* SQL Injection

SECUNIA ADVISORY ID: SA29741

VERIFY ADVISORY: http://secunia.com/advisories/29741/

CRITICAL: Moderately critical

IMPACT: Manipulation of data

SOFTWARE: Coppermine Photo Gallery 1.x http://secunia.com/product/1427/

DESCRIPTION: A vulnerability has been reported in Coppermine Photo Gallery, which can be exploited by malicious people to conduct SQL injection attacks. The vulnerability is reported in version 1.4.17. Prior versions may also be affected.

Input passed to unspecified cookies in bridge/coppermine.inc.php is not properly sanitized before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

SOLUTION: Update to version 1.4.18.

PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.

ORIGINAL ADVISORY: http://forum.coppermine-gallery.net/index.php/topic,51882.0.html