Coppermine Photo Gallery vulnerabilities

A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the db_input.php file of the Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely, and the exploit is public. Upgrading to version 1.6.29 fixes the issue.

A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the profile.php file of the edit_profile Endpoint. Manipulating the Biography argument leads to cross site scripting. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 1.6.29 mitigates the issue.

Coppermine Photo Gallery versions 1.6.09 through 1.6.27 are vulnerable to path traversal. An unauthenticated remote attacker can exploit a vulnerable endpoint and construct payloads to read content of any file accessible by the web server process. The issue was fixed in version 1.6.28.