Back to KEVs

CVE-2008-1841

SQL injection vulnerability in the session handling functionality in bridge/coppermine.inc.php in Coppermine Photo Gallery (CPG) 1.4.17 and earlier...

Basic Information

CVE State
PUBLISHED
Reserved Date
April 16, 2008
Published Date
April 16, 2008
Last Updated
August 07, 2024
Vendor
Coppermine
Product
Photo Gallery
Description
SQL injection vulnerability in the session handling functionality in bridge/coppermine.inc.php in Coppermine Photo Gallery (CPG) 1.4.17 and earlier allows remote attackers to execute arbitrary SQL commands via an input field associated with the session_id variable, as exploited in the wild in April 2008. NOTE: the fix for CVE-2008-1840 was intended to address this vulnerability, but is actually inapplicable.
Tags
php

CVSS Scores

CVSS v2.0

6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploit Status

Exploited in the Wild
Yes (2008-04-16 17:00:00 UTC) Source

References

http://www.securityfocus.com/bid/28767 http://sourceforge.net/project/shownotes.php?group_id=89658&release_id=592069 http://forum.coppermine-gallery.net/index.php/topic%2C51882.0.html http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.4.x/bridge/coppermine.inc.php?r1=4380&r2=4381 https://exchange.xforce.ibmcloud.com/vulnerabilities/41788 http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.4.x/bridge/coppermine.inc.php?view=log http://secunia.com/advisories/29741

Known Exploited Vulnerability Information

Source Added Date
CVE 2008-04-16 17:00:00 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel