Detections
Analytics
Coppermine Gallery SQL Injection
high Nessus Network Monitor Plugin ID 2846
Synopsis
The remote host is vulnerable to a SQL Injection attack.Description
The remote host is running CopperMine Gallery, a set of PHP scripts to handle galleries of pictures. There is a flaw in this version of Coppermine Gallery. Specifically, the remote user's cookie is not properly parsed for SQL special characters. An attacker exploiting this flaw would send a malicious cookie to the Coppermine application. Successful exploitation would result in the attacker being able to read and write sensitive database data as well as potentially executing arbitrary code on the remote database.Solution
Upgrade to Coppermine greater than 1.3.2.See Also
http://www.waraxe.us/advisory-42.html
Plugin Details
Severity: High
ID: 2846
Family: CGI
Published: 4/20/2005
Updated: 3/6/2019
Nessus ID: 18101
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:coppermine:coppermine_photo_gallery
Reference Information
CVE: CVE-2005-1225, CVE-2005-1226