Exploitation Summary
EIP tracks 1 public exploit for CVE-2008-3486. PoCs published by EgiX.
AI-analyzed exploit summary This exploit leverages a Local File Inclusion (LFI) vulnerability in Coppermine Photo Gallery <= 1.4.18, allowing remote code execution by manipulating the USER['lang'] cookie parameter to include arbitrary local files. The exploit includes a full interactive shell for post-exploitation.
Description
Directory traversal vulnerability in the user_get_profile function in include/functions.inc.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang part of serialized data in an _data cookie.
Exploits (1)
This exploit leverages a Local File Inclusion (LFI) vulnerability in Coppermine Photo Gallery <= 1.4.18, allowing remote code execution by manipulating the USER['lang'] cookie parameter to include arbitrary local files. The exploit includes a full interactive shell for post-exploitation.