CVE-2008-0504
Coppermine Photo Gallery < 1.4.15 - Authenticated SQL Injection via Album Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-0504. PoCs published by bazik.
AI-analyzed exploit summary This exploit targets a SQL injection vulnerability in Coppermine Gallery 1.4.10, leveraging deserialization and cookie manipulation to write a PHP web shell to the target system. It automates the process of retrieving necessary paths and prefixes before executing the payload.
Description
Multiple SQL injection vulnerabilities in Coppermine Photo Gallery (CPG) before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) albumid, (2) startpic, and (3) numpics parameters to util.php; and (4) cid_array parameter to reviewcom.php.
Exploits (1)
This exploit targets a SQL injection vulnerability in Coppermine Gallery 1.4.10, leveraging deserialization and cookie manipulation to write a PHP web shell to the target system. It automates the process of retrieving necessary paths and prefixes before executing the payload.