logo Home

Untitled Document

Home > Archives Advisories > Articles

Untitled Document

Untitled Document

Coppermine Photo Gallery remote compromise
Date: 2003-04-07

Author : Berend-Jan Wever<SkyLined@edup.tudelft.nl>

From the website, http://www.chezgreg.net/coppermine/:

"Coppermine Photo Gallery is a picture gallery script. Users can upload
pictures with a web browser (thumbnails are created on the fly), add
comments, send e-cards and view statistics about the pictures. "
"The script use PHP, a MySQL database and the GD library (version 1.x or
2.x) or ImageMagick to make the thumbnails. An install script makes the
installation very fast and easy."

The problem was found in Coppermine 1.0 RC3, the latest stable release. The
latest beta (1.1 beta 2) is not affected according to the author.

Coppermine allows the uploading of images onto a server by logged in users
and in a lot of configurations even anonymous uploading. The upload script
has a buggy extention checking routine which allows the uploading of
".jpg.php" files. These files need to be a valid jpg-files or Coppermine
will delete them. It is trivial to create a file which is a valid jpg and
also a valid PHP script. Once uploaded, the PHP script can then be executed,
allowing access to the remote server under the priviledges of the user PHP
is running under.

Attached is a working exploit, upload this onto a vulnerable server and
execute it like this:
Where command can be something like "id;uname%20-a" or "cat%20/etc/passwd"
Note 1: MSIE will display Copperminer.jpg.php as an image, but lynx will
display the output of the command you gave it.
Note 2: http://www.google.com/search?q=allinurl%3A+/upload.php?album=

mar 31, 2003 - Issue discovered, working exploit written.
mar 31, 2003 - Author contacted, problem aknowledged by author.
apr 05, 2003 - Patches released through Coppermine website.
apr 07, 2003 - Information disclosed.

Can be found at http://www.chezgreg.net/coppermine/

Kind regards,

Berend-Jan Wever


arrowSearch Advisories


Free weekly Newsletter.

Please enter your email address here:
arrowReport Vulnerability

If you've found a vulnerability please
click here to report it.


About Us | Contact Us | Advertise | email | Backend flag
Copyright © 2016-2017 Security Corporation - All Rights Reserved - Legal - Privacy Policy