Bugtraq mailing list archives
Re: Coppermine exploit used by a Chase Phish?
From: Nexus <nexus.logik () gmail com>
Date: Sat, 11 Mar 2006 17:43:50 -0500
Coppermine is subjectable to multiple exploits, for the most part exploiters do not need to have much knowledge of it's working. There is a script called nst.php which is saved as a rar file and uploaded into the coppermine (unless coppermine is properly configured to now access anything bt image files) this nst.php script allows them to run a local acct on the system and browse through directories,upload new files even access sql u/p and the sql database. there is a good possablity this is what happened
some kid hacked the coppermine using a script simular to the "nst.php" uploaded it, got into the sever, and simply uplaoded the phish script. pretty easy to do actually, and a simple google search for "[subject],powered by coppermine" will give a extended list of possible targets for the exploiter to attack.
Paul Laudanski wrote:
I got sent a Chase phish email tonight and in checking it out it appears to be live on a Coppermine gallery installation. Is this a new exploit of Coppermine, or just this site hasn't been yet patched?A photo of the phish site with the URL (domain blacked out): http://castlecops.com/p728141-Mar_10_Phish_Alerts.html#728141
Current thread:
- Coppermine exploit used by a Chase Phish? Paul Laudanski (Mar 11)
- Re: Coppermine exploit used by a Chase Phish? Nexus (Mar 13)