Exploitation Summary
CVE-2008-1840 has been observed exploited in the wild (reported by VulnCheck KEV).
Description
SQL injection vulnerability in upload.php in Coppermine Photo Gallery (CPG) 1.4.16 and earlier allows remote authenticated users or user-assisted remote HTTP servers to execute arbitrary SQL commands via the Content-Type HTTP response header provided by the HTTP server that is used for an upload.
References (6)
Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/41784
Patch x_refsource_confirm
http://sourceforge.net/project/shownotes.php?group_id=89658&release_id=592069
Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/28766
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/29795
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/44345
Various Sources x_refsource_confirm
http://forum.coppermine-gallery.net/index.php/topic%2C51787%2C0.html
Scores
EPSS
0.0177
EPSS Percentile
75.9%
Details
VulnCheck KEV
2008-04-16
CWE
CWE-89
Status
published
Products (16)
coppermine/coppermine_photo_gallery
1.4
coppermine/coppermine_photo_gallery
1.4.1
coppermine/coppermine_photo_gallery
1.4.2
coppermine/coppermine_photo_gallery
1.4.3
coppermine/coppermine_photo_gallery
1.4.4
coppermine/coppermine_photo_gallery
1.4.5
coppermine/coppermine_photo_gallery
1.4.6
coppermine/coppermine_photo_gallery
1.4.7
coppermine/coppermine_photo_gallery
1.4.8
coppermine/coppermine_photo_gallery
1.4.9
... and 6 more
Published
Apr 16, 2008
Tracked Since
Feb 18, 2026