CVE-2008-1841

High PUBLISHED

SQL injection vulnerability in the session handling functionality in bridge/coppermine.inc.php in Coppermine Photo Gallery (CPG) 1.4.17 and earlier...

Coppermine · Photo Gallery

Not yet in CISA KEV

Exploited in the wild

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

High

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

Not yet in CISA KEV

CVSS / EPSS

6.8 Medium

At a Glance

SQL injection vulnerability in the session handling functionality in bridge/coppermine.inc.php in Coppermine Photo Gallery (CPG) 1.4.17 and earlier allows remote attackers to execute arbitrary SQL commands via an input field associated with the session_id variable, as exploited in the wild in April 2008. NOTE: the fix for CVE-2008-1840 was intended to address this vulnerability, but is actually inapplicable.

php

CVE Published: Apr 16, 2008
Exploitation Reported: Apr 16, 2008
CVSS: 6.8 Medium
EPSS: —

Remote Unauthenticated

Affected Versions

Vendor	Product	Version	Status
n/a	n/a	n/a	Affected

CVE References

29741 secunia.com · Third-Party Advisory http://secunia.com/advisories/29741
28767 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/28767
coppermine-coppermineinc-sql-injection(41788) exchange.xforce.ibmcloud.com · VDB Entry https://exchange.xforce.ibmcloud.com/vulnerabilities/41788
sourceforge.net/project/shownotes.php sourceforge.net · CVE Record http://sourceforge.net/project/shownotes.php?group_id=89658&release_i...
forum.coppermine-gallery.net/index.php/topic%2C51882.0.html forum.coppermine-gallery.net · CVE Record http://forum.coppermine-gallery.net/index.php/topic%2C51882.0.html

Show 2 more references

coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.4.x/bridge/copp... coppermine.svn.sourceforge.net · CVE Record http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.4....
coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.4.x/bridge/copp... coppermine.svn.sourceforge.net · CVE Record http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.4....

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CVE First	2008-04-16 17:00 UTC

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2008-1841

{
  "cve_id": "CVE-2008-1841",
  "title": "SQL injection vulnerability in the session handling functionality in bridge/c...",
  "affected_vendor": "Coppermine",
  "affected_product": "Photo Gallery",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "High",
  "cvss_score": 6.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.