Vulnerability Name:

CVE-2006-0872 (CCN-24814)

Assigned:2006-02-17
Published:2006-02-17
Updated:2017-07-20
Summary:Directory traversal vulnerability in init.inc.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the lang parameter.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: BugTraq Mailing List, Fri Feb 17 2006 - 22:57:37 CST
Coppermine Photo Gallery <=1.4.3 remote code execution

Source: CONFIRM
Type: Patch
http://coppermine-gallery.net/forum/index.php?topic=28062.0

Source: MITRE
Type: CNA
CVE-2006-0872

Source: CCN
Type: Altervista.org Web site
Coppermine Photo Gallery <= 1.4.3 arbitrary local/remote inclusion

Source: MISC
Type: Exploit
http://retrogod.altervista.org/cpg_143_adv.html

Source: MISC
Type: Exploit
http://retrogod.altervista.org/cpg_143_incl_xpl.html

Source: CCN
Type: SA18941
Coppermine Photo Gallery File Inclusion Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
18941

Source: CCN
Type: SECTRACK ID: 1015646
Coppermine Photo Gallery Include File Bugs in `include/init.inc.php` and `docs/showdoc.php` Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: Exploit
1015646

Source: CCN
Type: SourceForge.net
Project: Coppermine Photo Gallery: Summary

Source: CCN
Type: OSVDB ID: 23346
Coppermine Photo Gallery init.inc.php lang Parameter Local File Inclusion

Source: BUGTRAQ
Type: UNKNOWN
20060218 Coppermine Photo Gallery <=1.4.3 remote code execution

Source: BID
Type: UNKNOWN
16718

Source: CCN
Type: BID-16718
Coppermine Multiple File Include Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2006-0669

Source: XF
Type: UNKNOWN
coppermine-init-file-include(24814)

Source: XF
Type: UNKNOWN
coppermine-init-file-include(24814)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:coppermine:coppermine_photo_gallery:1.4.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    coppermine coppermine photo gallery 1.4.3