PT-2023-25873 · Piwigo · Piwigo

Scgajge12 · Published 2023-07-07 · Updated 2023-07-14 · CVE-2023-37270

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 13.8.0

Description Piwigo is open source photo gallery software. There is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header User-Agent is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be logged in to the administrator screen, even with low privileges. Any SQL statement can be executed, which may leak information from the database.

Recommendations For versions prior to 13.8.0, update to version 13.8.0 to resolve the issue. As a temporary workaround, consider escaping the parameter contents appropriately for those who want to execute a SQL statement verbatim with user-enterable parameters.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-37270

GHSA-934W-QJ9P-3QCX

Affected Products

Piwigo

References · 11

• 🔥 https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37270.json · Exploit
• https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a · Patch
• https://osv.dev/vulnerability/CVE-2023-37270 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37270 · Security Note
• https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621 · Note
• https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491 · Note
• https://t.me/cvenotify/54374 · Telegram Post
• https://piwigo.org/release-13.8.0 · Note
• https://t.me/cibsecurity/66235 · Telegram Post
• https://t.me/cvenotify/53905 · Telegram Post