CVE-2008-1841: SQL Injection
SQL injection vulnerability in the session handling functionality in bridge/coppermine.inc.php in Coppermine Photo Gallery (CPG) 1.4.17 and earlier allows remote attackers to execute arbitrary SQL commands via an input field associated with the sessionid variable, as exploited in the wild in April 2008. NOTE: the fix for CVE-2008-1840 was intended to address this vulnerability, but is actually inapplicable.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1841?
CVE-2008-1841 is rated as a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2008-1841?
To fix CVE-2008-1841, upgrade to the latest version of Coppermine Photo Gallery that no longer contains the SQL injection vulnerability.
Which versions are affected by CVE-2008-1841?
CVE-2008-1841 affects Coppermine Photo Gallery versions 1.4.17 and earlier.
What kind of attack can exploit CVE-2008-1841?
CVE-2008-1841 can be exploited through SQL injection, allowing attackers to manipulate the database by executing arbitrary SQL queries.
Is there a workaround for CVE-2008-1841?
A workaround for CVE-2008-1841 is to validate and sanitize input fields associated with the session_id variable, but upgrading is strongly recommended.