Phishing & BotNets
Re: Coppermine exploit used by a Chase Phish? Mar 11 2006 10:43PM
Nexus (nexus logik gmail com)
Coppermine is subjectable to multiple exploits, for the most part
exploiters do not need to have much knowledge of it's working. There is
a script called nst.php which is saved as a rar file and uploaded into
the coppermine (unless coppermine is properly configured to now access
anything bt image files) this nst.php script allows them to run a local
acct on the system and browse through directories,upload new files even
access sql u/p and the sql database. there is a good possablity this is
what happened

some kid hacked the coppermine using a script simular to the "nst.php"
uploaded it, got into the sever, and simply uplaoded the phish script.
pretty easy to do actually, and a simple google search for
"[subject],powered by coppermine" will give a extended list of possible
targets for the exploiter to attack.

Paul Laudanski wrote:
> I got sent a Chase phish email tonight and in checking it out it appears
> to be live on a Coppermine gallery installation. Is this a new exploit of
> Coppermine, or just this site hasn't been yet patched?
>
> A photo of the phish site with the URL (domain blacked out):
>
> http://castlecops.com/p728141-Mar_10_Phish_Alerts.html#728141
>
>

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus