1. CVE-Search
  2. CVE-2007-0122
ID CVE-2007-0122
Summary Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via (1) the cat parameter to albmgr.php, and possibly (2) the gid parameter to usermgr.php; (3) the start parameter to db_ecard.php; and the albumid parameter to unspecified files, related to the (4) filename_to_title and (5) del_titles functions.
References
Vulnerable Configurations
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.0_rc3:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.0_rc3:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.1:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.1_beta_2:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.1_beta_2:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.2:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.2.2_b:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.2.2_b:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.2.2_b-nuke:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.2.2_b-nuke:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.9:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.9:*:*:*:*:*:*:*
  • cpe:2.3:a:coppermine:coppermine_photo_gallery:*:*:*:*:*:*:*:*
    cpe:2.3:a:coppermine:coppermine_photo_gallery:*:*:*:*:*:*:*:*
CVSS
Base: 6.5 (as of 16-10-2018 - 16:31)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:P/A:P
refmap via4
bid 21894
bugtraq 20070105 Coppermine Photo Gallery <= 1.4.10 SQL Injection Exploit
exploit-db 3085
misc http://acid-root.new.fr/poc/19070104.txt
osvdb
  • 35852
  • 35853
  • 35854
  • 35855
  • 35856
secunia 25846
sreason 2123
Last major update 16-10-2018 - 16:31
Published 09-01-2007 - 02:28
Last modified 16-10-2018 - 16:31
Back to Top