PT-2017-14622 · Piwigo · Piwigo

Xcold · Published 2017-12-01 · Updated 2017-12-19 · CVE-2017-16893

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.9.3

Description The issue allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The "tags.php" endpoint is affected, specifically the edit list parameter, which is not sanitized and is used to construct an SQL query to retrieve a list of registered users into the application.

Recommendations For Piwigo version 2.9.2 and possibly prior, update to a version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the "tags.php" endpoint or sanitizing the edit list parameter to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-16893

Affected Products

Piwigo

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-16893 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16893 · Vendor Advisory
• https://github.com/Piwigo/Piwigo/issues/804 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16893 · Note