CVE-2008-0504
Estado: ModificadaMedia (6.5)—💥 Exploit
Multiple SQL injection vulnerabilities in Coppermine Photo Gallery (CPG) before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) albumid, (2) startpic, and (3) numpics parameters to util.php; and (4) cid_array parameter to reviewcom.php.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.97%
- Percentil entre todas las CVEs puntuadas: 80
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Publicado en Exploit-DB · Coppermine Photo Gallery 1.4.10 - 'cpg1410_xek.php' SQL Injection (21/1/2008)
Tecnologías afectadas (1)
CWE
- CWE-89
Referencias
- http://coppermine-gallery.net/forum/index.php?topic=50103.0
- http://secunia.com/advisories/28682
- http://www.securityfocus.com/archive/1/487351/100/200/threaded
- http://www.securityfocus.com/bid/27509
- http://www.securitytracker.com/id?1019285
- http://www.vupen.com/english/advisories/2008/0367
- http://www.waraxe.us/advisory-66.html
- http://coppermine-gallery.net/forum/index.php?topic=50103.0
- http://secunia.com/advisories/28682
- http://www.securityfocus.com/archive/1/487351/100/200/threaded
- http://www.securityfocus.com/bid/27509
- http://www.securitytracker.com/id?1019285
- http://www.vupen.com/english/advisories/2008/0367
- http://www.waraxe.us/advisory-66.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2008-0504",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": true,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2008-01-31T20:00:00.000",
"references": [
{
"url": "http://coppermine-gallery.net/forum/index.php?topic=50103.0",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/28682",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/487351/100/200/threaded",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/27509",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id?1019285",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2008/0367",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.waraxe.us/advisory-66.html",
"source": "cve@mitre.org"
},
{
"url": "http://coppermine-gallery.net/forum/index.php?topic=50103.0",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/28682",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/487351/100/200/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/27509",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1019285",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2008/0367",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.waraxe.us/advisory-66.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Coppermine Photo Gallery (CPG) before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) albumid, (2) startpic, and (3) numpics parameters to util.php; and (4) cid_array parameter to reviewcom.php."
},
{
"lang": "es",
"value": "Múltiples vulnerabilidades de inyección SQL en Coppermine Photo Gallery (CPG) en versiones anteriores a la 1.4.15 permiten que administradores remotos autenticados ejecuten comandos SQL arbitrarios mediante los parámetros (1) albumid, (2) startpic y (3) numpics en util.php; y el parámetro (4) cid_array en reviewcom.php."
}
],
"lastModified": "2026-06-16T22:49:45.947",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3823A84F-9E42-4E55-849E-C1A0F220D3EA",
"versionEndIncluding": "1.4.14"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E358276F-157E-4D98-9055-061E6F2F2948"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.0:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9A1831F9-4B4A-4226-B219-B3AFF06FFDBA"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C457C25-AF6B-4F67-BD3B-83361A48CDBB"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.1:beta_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "808B8E20-BE09-4FC2-BC73-2F10261E82B5"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2003E2A5-A902-45A1-9189-15B956976ECD"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BE1E44B7-ACBD-4CBB-801E-18EACBC0EA58"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A53D1BF-C884-40F9-9D46-9CCD9ADC183E"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.2.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "34A35889-023F-4305-A5A8-F7A8D3409172"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E51F81AC-6AE1-40E5-B2CB-34E1B5985C93"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.2.1:b:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A465AB3-1426-4966-87DF-A1FA3FCCE5A9"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.2.1:b-nuke:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E9D7FF03-F2A7-4014-BF17-8393F5220AC4"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC98C672-0D2E-4A78-A206-CC44A5A6E14E"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7434F90-B968-4385-B2DE-34706DC251A6"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6968BAC8-742D-4880-A936-198F89F4E63F"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "92CCBC14-1FBC-46C0-AB0B-BB39264B1C04"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B309A98E-6FA2-4741-9497-2A7A1E255C93"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3290C2FD-600E-4CB8-BB46-6750B4AA389B"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4C237F5-4E77-43E3-A10C-0921859F991E"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CFE435D-3CF9-4F43-B704-829E648449B0"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4.0:alpha:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4AFF3F0F-88BF-4EB4-8DCA-4D46D181FCF2"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4.0:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "940D9B5B-7828-4CDC-8BA9-311AD1CF8AEB"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A3867BDE-B72A-4F7C-9A8A-20C8ECE608CD"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4.1:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "196B664C-C400-4770-893B-E327D40CD525"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ECEE8E75-36D2-4F99-967E-52FDFA150E17"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8946662-2C1C-4113-977F-5D7FC3161565"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2F59212-9725-4926-9905-28C8C64A3A58"
},
{
"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5FB7773-BBCA-4825-8489-7EE43D6BD312"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}