PT-2022-11214 · Piwigo · Piwigo

Holaasuka · Published 2022-05-26 · Updated 2022-06-01 · CVE-2021-40317

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Piwigo version 11.5.0

Description The issue is a SQL injection vulnerability. It can be exploited via the "admin.php" endpoint and the id parameter.

Recommendations For Piwigo version 11.5.0, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the "admin.php" endpoint to minimize the risk of exploitation. Avoid using the id parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-40317

Affected Products

Piwigo

References · 5

• 🔥 https://github.com/Piwigo/Piwigo/issues/1470 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-40317 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40317 · Vendor Advisory
• https://t.me/cvenotify/30951 · Telegram Post
• https://t.me/cibsecurity/43371 · Telegram Post