vulnwire
6.5med

CVE-2007-01221 exploit

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and earlier allow remote authenticated administrators to execute…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
6.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.2%
percentile 88%
Public exploits
1
Exploit-DB

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via (1) the cat parameter to albmgr.php, and possibly (2) the gid parameter to usermgr.php; (3) the start parameter to db_ecard.php; and the albumid parameter to unspecified files, related to the (4) filename_to_title and (5) del_titles functions.

Exploit prediction (EPSS)

3.20% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.

Exploits and detections

  • EDB-29397 Coppermine Photo Gallery 1.4.11 - SQL Injection · webapps · 2007-01-05

CVSS scores

Assigned byVersionScoreVector
NVD2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P

References

  • osvdb.org /35853 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityreason.com /securityalert/2123 · third-party-advisory, x_refsource_SREASON, x_transferred
  • secunia.com /advisories/25846 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • acid-root.new.fr /poc/19070104.txt · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/3085 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • osvdb.org /35854 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /35852 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /archive/1/456051/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /bid/21894 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /35856 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /35855 · vdb-entry, x_refsource_OSVDB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.