CVE-2008-0506: Coppermine Photo Gallery command injection via ImageMagick parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote command execution with public exploit code and very high EPSS, though the CVSS 2.0 score is only 6.8 and KEV does not list it.

What it is

Coppermine Photo Gallery before 1.4.15 fails to validate the quality, angle, and clipval parameters passed to picEditor.php when the ImageMagick picture processing method is configured. Shell metacharacters in those parameters are passed to the underlying command, allowing remote command execution. The flaw matters because it gives an unauthenticated network attacker a path to run arbitrary commands on the web server.

Impact

An attacker can execute arbitrary shell commands with the privileges of the web server process, leading to data theft, web shell placement, or full host compromise. The CVSS 2.0 vector rates partial confidentiality, integrity, and availability impact.

Attack surface

Reached remotely over the network through HTTP requests to picEditor.php, specifically the quality, angle, or clipval parameters. The CVSS vector shows no authentication required (Au:N) and medium access complexity, and the description does not require user interaction.

Exploitation

Public exploit code exists (Exploit-DB 5019 and a SecurityFocus BID tagged Exploit), and EPSS is 0.58902 (99th percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Upgrade Coppermine Photo Gallery to 1.4.15 or later, which the vendor patch addresses.
• If ImageMagick processing is not required, switch the gallery to the GD picture processing method to remove the vulnerable code path.
• Restrict network access to picEditor.php and administrative gallery endpoints to trusted users only.
• Run the web server and PHP process under a low-privilege account with no shell access to limit command execution impact.
• Apply input validation or a WAF rule blocking shell metacharacters in the quality, angle, and clipval parameters.

Detection

• Monitor web server logs for requests to picEditor.php containing shell metacharacters (;, |, &, $, `, backticks) in the quality, angle, or clipval parameters.
• Alert on unexpected child processes spawned by the web server or PHP-FPM process, especially ImageMagick or shell binaries.
• Review file integrity in the web root for newly written PHP files or web shells following gallery image operations.
• Correlate outbound network connections from the web server host with picEditor.php request activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.