Detections
Analytics
Coppermine Photo Gallery < 1.3.2 Multiple SQL Injections
high Nessus Plugin ID 18101
Language:
Synopsis
The remote web server contains a PHP application that is affected by multiple issues.Description
According to its version number, the version of Coppermine Photo Gallery installed on the remote host suffers from multiple SQL injection vulnerabilities due to its failure to sanitize user-supplied cookie data before using it in SQL queries in the scripts 'include/functions.inc.php' as well as 'zipdownload.php'. An attacker may be able to use the first flaw to reveal sensitive data and the second to download any file accessible to the web server userid on the remote host, although access to 'zipdownload.php' is not enabled by default.In addition, the application reportedly stores passwords in its database as plaintext. A attacker who successfully exploits one of the SQL injection flaws above is likely to easily gain control of the affected application.
Solution
Upgrade to Coppermine Photo Gallery version 1.3.3 or later.See Also
http://www.waraxe.us/advisory-42.html
Plugin Details
Severity: High
ID: 18101
File Name: coppermine_gallery_favpics_sql_injection.nasl
Version: 1.20
Type: remote
Family: CGI abuses
Published: 4/21/2005
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:coppermine:coppermine_photo_gallery
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 4/20/2004
Reference Information
CVE: CVE-2005-1225, CVE-2005-1226