bugtraq - Re: Coppermine exploit used by a Chase Phish?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <441352A6.4020903@gmail.com>
Date: Sat, 11 Mar 2006 17:43:50 -0500
From: Nexus <nexus.logik@...il.com>
To: Paul Laudanski <zx@...tlecops.com>
Cc: phishing@...urityfocus.com, bugtraq@...urityfocus.com
Subject: Re: Coppermine exploit used by a Chase Phish?

Coppermine is subjectable to multiple exploits, for the most part 
exploiters do not need to have much knowledge of it's working. There is 
a script called nst.php which is saved as a rar file and uploaded into 
the coppermine (unless coppermine is properly configured to now access 
anything bt image files) this nst.php script allows them to run a local 
acct on the system and browse through directories,upload new files even 
access sql u/p and the sql database. there is a good possablity this is 
what happened

some kid hacked the coppermine using a script simular to the "nst.php" 
uploaded it, got into the sever, and simply uplaoded the phish script. 
pretty easy to do actually, and a simple google search for 
"[subject],powered by coppermine" will give a extended list of possible 
targets for the exploiter to attack.

Paul Laudanski wrote:
> I got sent a Chase phish email tonight and in checking it out it appears 
> to be live on a Coppermine gallery installation.  Is this a new exploit of 
> Coppermine, or just this site hasn't been yet patched?
>
> A photo of the phish site with the URL (domain blacked out):
>
> http://castlecops.com/p728141-Mar_10_Phish_Alerts.html#728141
>
>