PT-2017-18936 · Piwigo · Piwigo

Eric Castaã±Eda · Publicado 2017-06-14 · Atualizado 2017-06-19 · CVE-2017-9463

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.9.0

Description The issue allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The user list backend.php component is affected, specifically the values of the iDisplayStart and iDisplayLength parameters, which are not sanitized and are used to construct a SQL query to retrieve a list of registered users.

Recommendations For Piwigo version 2.9.0 and possibly prior, as a temporary workaround, consider sanitizing the iDisplayStart and iDisplayLength parameters in the user list backend.php component to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-9463

Produtos afetados

Piwigo

Referências · 6

• https://github.com/Piwigo/Piwigo/issues/705 · Correção
• https://github.com/Piwigo/Piwigo/commit/42920897ce927c236728d387f61bf03d117109a2 · Correção
• https://osv.dev/vulnerability/CVE-2017-9463 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9463 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-9463 · Nota de Segurança
• https://wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-003 · Nota