Description
SQL injection vulnerability in Coppermine Photo Gallery 1.3.2 allows remote attackers to execute arbitrary SQL commands via the favs parameter to (1) init.inc.php or (2) zipdownload.php.
References
- 20050420 [waraxe-2005-SA#042] - Multiple vulnerabilities in Coppermine Photo Gallery 1.3.2 mailing-list
- coppermine-initincphp-sql-injection(20205) vdb-entry
- 15004 third-party-advisory
- http://www.waraxe.us/advisory-42.html