FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-1909

This CVE name corresponds to:

Entered	Topic
2006-05-22	coppermine -- "file" Local File Inclusion Vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-1909 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-1909
Phase	Assigned(20060420)

Description

Directory traversal vulnerability in index.php in Coppermine 1.4.4 allows remote attackers to read arbitrary files via a .//./ (modified dot dot slash) in the file parameter, which causes a regular expression to collapse the sequences into standard "../" sequences.

References

Source	Reference
BUGTRAQ	20060415 [KAPDA]CopperminePhotoGallery1.4.4~ PluginInclusionSystem(index.php)~ RemoteFileInclusion attack
BUGTRAQ	20060416 Re: [KAPDA]CopperminePhotoGallery1.4.4~ PluginInclusionSystem(index.php)~ RemoteFileInclusion attack
MISC	http://myimei.com/security/2006-04-14/copperminephotogallery144-plugininclusionsystemindexphp-remotefileinclusion-attack.html
BID	17570
VUPEN	ADV-2006-1392
SECUNIA	19665
XF	coppermine-index-file-include(25866)