CVE-2007-0115

Static code injection vulnerability in Coppermine Photo Gallery 1.4.10 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the Username to login.php, which is injected into an error message in security.log.php, which can then be accessed using viewlog.php.

CVSS v2.0 6.0 MEDIUM

6.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://acid-root.new.fr/poc/19070104.txt	Exploit
http://osvdb.org/33383
http://securityreason.com/securityalert/2107
http://www.attrition.org/pipermail/vim/2007-January/001218.html	Exploit
http://www.securityfocus.com/archive/1/456051/100/0/threaded

Configurations

Configuration 1 (hide)

cpe:2.3:a:coppermine:coppermine_photo_gallery:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2007-01-09 02:28

Updated : 2023-12-10 10:40

NVD link : CVE-2007-0115

Mitre link : CVE-2007-0115

CVE.ORG link : CVE-2007-0115

JSON object : View

Products Affected

coppermine

coppermine_photo_gallery

CWE

NVD-CWE-Other

{"id": "CVE-2007-0115", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2007-01-09T02:28:00.000", "references": [{"url": "http://acid-root.new.fr/poc/19070104.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://osvdb.org/33383", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/2107", "source": "cve@mitre.org"}, {"url": "http://www.attrition.org/pipermail/vim/2007-January/001218.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/456051/100/0/threaded", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Static code injection vulnerability in Coppermine Photo Gallery 1.4.10 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the Username to login.php, which is injected into an error message in security.log.php, which can then be accessed using viewlog.php."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n de c\u00f3digo est\u00e1tico en coppermine Photo Gallery 1.4.10 y anteriores permite a administradores autenticados remotamente ejecutar c\u00f3digo PHP de su elecci\u00f3n a trav\u00e9s del Nombre de Usuario para login.php, el cual es inyectado dentro de un mensaje de error en security.log.php, que puede ser accedido utilizando viewlog.php."}], "lastModified": "2018-10-16T16:31:16.527", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coppermine:coppermine_photo_gallery:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E1F67DD-8ED5-4E97-9EBE-3EDC01DE60BB", "versionEndIncluding": "1.4.10"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}