CVE-2004-1984: Medium severity Coppermine Coppermine Photo Gallery vulnerability

Published May 2, 2004

Updated

Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers to obtain sensitive information via a direct HTTP request to (1) phpinfo.php, (2) addpic.php, (3) config.php, (4) dbinput.php, (5) displayecard.php, (6) ecard.php, (7) crop.inc.php, which reveal the full path in a PHP error message.

Affected Software

11 affected components

Coppermine Coppermine Photo Gallery=1.1_beta_2

Coppermine Coppermine Photo Gallery=1.2

Francisco Burzi PHP-Nuke=7.0

Francisco Burzi PHP-Nuke=7.2

Francisco Burzi PHP-Nuke=7.0_final

Coppermine Coppermine Photo Gallery=1.0_rc3

Coppermine Coppermine Photo Gallery=1.2.2_b

Coppermine Coppermine Photo Gallery=1.2.1

Coppermine Coppermine Photo Gallery=1.1_.0

Francisco Burzi PHP-Nuke=6.9

Francisco Burzi PHP-Nuke=7.1

Event History

May 2, 2004

CVE Published

04:00 AM

May 10, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1984?

CVE-2004-1984 has been classified as a high severity vulnerability due to potential exposure of sensitive information.

How do I fix CVE-2004-1984?

To fix CVE-2004-1984, upgrade to a secure version of Coppermine Photo Gallery that addresses this vulnerability.

What software is affected by CVE-2004-1984?

CVE-2004-1984 affects Coppermine Photo Gallery versions 1.2.2b, 1.2.1, 1.1 beta, and earlier versions, as well as specific versions of PHP-Nuke.

Can CVE-2004-1984 lead to further attacks?

Yes, CVE-2004-1984 can potentially lead to further exploitation by revealing server paths to attackers.

What specific files are exploited in CVE-2004-1984?

CVE-2004-1984 can be exploited through direct HTTP requests to files like phpinfo.php, config.php, and db_input.php.