PT-2017-18936 · Piwigo · Piwigo

Eric Castaã±Eda · Published 2017-06-14 · Updated 2017-06-19 · CVE-2017-9463

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.9.0

Description The issue allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The user list backend.php component is affected, specifically the values of the iDisplayStart and iDisplayLength parameters, which are not sanitized and are used to construct a SQL query to retrieve a list of registered users.

Recommendations For Piwigo version 2.9.0 and possibly prior, as a temporary workaround, consider sanitizing the iDisplayStart and iDisplayLength parameters in the user list backend.php component to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-9463

Affected Products

Piwigo

References · 6

• https://github.com/Piwigo/Piwigo/issues/705 · Patch
• https://github.com/Piwigo/Piwigo/commit/42920897ce927c236728d387f61bf03d117109a2 · Patch
• https://osv.dev/vulnerability/CVE-2017-9463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9463 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9463 · Note
• https://wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-003 · Note