CVE-2006-6123: XSS
Coppermine Photo Gallery (CPG) 1.4.8 stable, with registerglobals enabled, allows remote attackers to bypass XSS protection and set arbitrary variables via a query string that causes the variable to be defined in global space, with separate GET, REQUEST, or other critical parameters, which are unset by the protection scheme and prevent the original variable from being detected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-6123?
The severity of CVE-2006-6123 is considered to be high due to its potential to allow remote code execution.
How do I fix CVE-2006-6123?
To fix CVE-2006-6123, disable register_globals in the PHP configuration and update to a patched version of Coppermine Photo Gallery.
What vulnerabilities does CVE-2006-6123 exploit?
CVE-2006-6123 exploits the register_globals configuration in PHP, leading to unauthorized variable access.
What versions of Coppermine Photo Gallery are affected by CVE-2006-6123?
CVE-2006-6123 specifically affects Coppermine Photo Gallery version 1.4.8 stable.
Can CVE-2006-6123 allow XSS attacks?
Yes, CVE-2006-6123 can potentially allow attackers to bypass XSS protections due to improper handling of input parameters.