CVE-2008-0504

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery (CPG) before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) albumid, (2) startpic, and (3) numpics parameters to util.php; and (4) cid_array parameter to reviewcom.php.

• CWE-89

• http://coppermine-gallery.net/forum/index.php?topic=50103.0Patch
• http://secunia.com/advisories/28682Vendor Advisory
• http://www.securityfocus.com/archive/1/487351/100/200/threaded
• http://www.securityfocus.com/bid/27509Patch
• http://www.securitytracker.com/id?1019285
• http://www.vupen.com/english/advisories/2008/0367Vendor Advisory
• http://www.waraxe.us/advisory-66.html
• http://coppermine-gallery.net/forum/index.php?topic=50103.0Patch
• http://secunia.com/advisories/28682Vendor Advisory
• http://www.securityfocus.com/archive/1/487351/100/200/threaded
• http://www.securityfocus.com/bid/27509Patch
• http://www.securitytracker.com/id?1019285
• http://www.vupen.com/english/advisories/2008/0367Vendor Advisory
• http://www.waraxe.us/advisory-66.html

Published

Jan 31, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-0498SQL injection vulnerability in main_bigware_53.tpl.php in Bi…
• CVE-2008-0499SQL injection vulnerability in Mambo LaiThai 4.5.5 allows re…
• CVE-2008-0500Multiple unspecified vulnerabilities in Mambo LaiThai 4.5.5 …
• CVE-2008-0501Directory traversal vulnerability in phpMyClub 0.0.1 allows …
• CVE-2008-0502PHP remote file inclusion vulnerability in templates/Officia…
• CVE-2008-0503Eval injection vulnerability in admin/op/disp.php in Netwerk…
• CVE-2008-0505Multiple cross-site scripting (XSS) vulnerabilities in docs/…
• CVE-2008-0506include/imageObjectIM.class.php in Coppermine Photo Gallery …
• CVE-2008-0507SQL injection vulnerability in adclick.php in the AdServe 0.…
• CVE-2008-0508Cross-site request forgery (CSRF) vulnerability in deans_per…
• CVE-2008-0509Multiple buffer overflows in IBM AIX 4.3 allow remote attack…
• CVE-2008-0510SQL injection vulnerability in index.php in the Newsletter (…