Coppermine Gallery - php file upload?

[Frank Hagan]

Andrew's quick action this morning caught a hacker on one of my customer's domains who had compromised a Coppermine Gallery script to send spam. My customer has version 1.4.1, where the Coppermine site shows 1.4.12 (not sure if that's iteration 12 of version 1.4, or iteration 2 of 1.4.1). The hacker was able to use the upload feature of Coppermine to upload an executable.

The site is suspended, and I'll be upgrading the script tonight. Could this be a simple configuration item, where the customer has allowed any kind of file to be uploaded? Or is this a vulnerability of Coppermine?

[AndrewT]

It could be either. I've never used the script but you'd certainly want to make sure it only allows you to upload actual images (certainly not PHP scripts). Perhaps someone that has used it can chime in regarding this. If it isn't a setting then I'd guess that it would be an exploit. Though more often than not, those small version changes are security patches and bug fixes. It is important to stay on them.

[Buddha]

Coppermine Photo Gallery <=1.4.3 remote code execution

[Frank Hagan]

Thanks, Buddah! That looks like what was done.