FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-0872

This CVE name corresponds to:

Entered	Topic
2006-05-22	coppermine -- File Inclusion Vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-0872 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-0872
Phase	Assigned(20060224)

Description

Directory traversal vulnerability in init.inc.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the lang parameter.

References

Source	Reference
BUGTRAQ	20060218 Coppermine Photo Gallery <=1.4.3 remote code execution
MISC	http://retrogod.altervista.org/cpg_143_adv.html
MISC	http://retrogod.altervista.org/cpg_143_incl_xpl.html
CONFIRM	http://coppermine-gallery.net/forum/index.php?topic=28062.0
BID	16718
VUPEN	ADV-2006-0669
SECTRACK	1015646
SECUNIA	18941
XF	coppermine-init-file-include(24814)