Coppermine Photo Gallery GLOBALS[USER[lang] Parameter Local File Inclusion

medium Nessus Plugin ID 38879

Language:

Synopsis

The remote web server contains a PHP script that is affected by a local file inclusion vulnerability.

Description

The version of Coppermine Photo Gallery installed on the remote host fails to filter user-supplied input to the 'GLOBALS[USER][lang]' parameter of the 'index.php' script before using it to include PHP code in 'includes/init.inc.php'. Provided PHP's 'register_globals' setting is enabled, an unauthenticated attacker can exploit this issue to view arbitrary files or possibly to execute arbitrary PHP code on the remote host subject to the privileges of the web server user id.

Note that this install is also likely to be affected by several SQL injection vulnerabilities, although Nessus has not checked for them.

Solution

Upgrade to Coppermine Photo Gallery version 1.4.23 or later.

Plugin Details

Severity: Medium

ID: 38879

File Name: coppermine_globals_user_lang_lfi.nasl

Version: 1.14

Type: remote

Family: CGI abuses

Published: 5/25/2009

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/a:coppermine:coppermine_photo_gallery

Required KB Items: www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Reference Information

SECUNIA: 35144

Detections

Analytics