vendor:
Coppermine Photo Gallery
by:
EgiX
9.3
CVSS
HIGH
LFI/Remote Code Execution
94
CWE
Product Name: Coppermine Photo Gallery
Affected Version From: 1.4.18
Affected Version To: 1.4.18
Patch Exists: YES
Related CWE: N/A
CPE: a:coppermine-gallery:coppermine_photo_gallery
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Coppermine Photo Gallery <= 1.4.18 LFI / Remote Code Execution Exploit
This exploit is based on the vulnerable code in /include/init.inc.php, which allows an attacker to inject malicious code into the application. The vulnerable code is located at lines 263-335, which allows an attacker to inject malicious code into the application. The attacker can use the 'lang' parameter to inject malicious code into the application, which can be used to execute arbitrary code on the server.
Mitigation:
The application should be updated to the latest version and the 'lang' parameter should be sanitized to prevent malicious code injection.
