CVE-2008-1841

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2008-1841
SQL injection vulnerability in the session handling functionality in bridge/coppermine.inc.php in Coppermine Photo Gallery (CPG) 1.4.17 and earlier allows remote attackers to execute arbitrary SQL commands via an input field associated with the session_id variable, as exploited in the wild in April 2008. NOTE: the fix for CVE-2008-1840 was intended to address this vulnerability, but is actually inapplicable.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.4.x/bridge/coppermine.inc.php?r1=4380&r2=4381
http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.4.x/bridge/coppermine.inc.php?view=log
http://forum.coppermine-gallery.net/index.php/topic%2C51882.0.html
http://secunia.com/advisories/29741 Vendor Advisory
http://sourceforge.net/project/shownotes.php?group_id=89658&release_id=592069
http://www.securityfocus.com/bid/28767 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/41788
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:coppermine:coppermine_photo_gallery:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.2.0rc2:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3.3:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.3.5:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.4:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.5:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.6:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.7:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.8:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.9:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.10:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.11:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.12:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.13:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.14:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.16:*:*:*:*:*:*:*
cpe:2.3:a:coppermine:coppermine_photo_gallery:1.4.17:*:*:*:*:*:*:*
History

07 Nov 2023, 02:02

Type Values Removed Values Added
References
  • {'url': 'http://forum.coppermine-gallery.net/index.php/topic,51882.0.html', 'name': 'http://forum.coppermine-gallery.net/index.php/topic,51882.0.html', 'tags': ['Patch'], 'refsource': 'CONFIRM'}
  • () http://forum.coppermine-gallery.net/index.php/topic%2C51882.0.html -
Information

Published : 2008-04-16 17:05

Updated : 2023-12-10 10:51

NVD link : CVE-2008-1841

Mitre link : CVE-2008-1841

CVE.ORG link : CVE-2008-1841

JSON object : View

Products Affected

coppermine

  • coppermine_photo_gallery
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')