PT-2023-31914 · Lychee · Lychee

Highildyria · Published 2023-12-28 · Updated 2024-01-04 · CVE-2023-52082

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 5.0.2

Description Lychee, a free photo-management tool, is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DB LOG SQL=true and DB LOG SQL EXPLAIN=true. The defaults settings of Lychee are safe. It is estimated that around 7,328 devices are potentially affected, mainly distributed in China, Germany, and other countries.

Recommendations To work around this issue, disable SQL EXPLAIN logging. For versions prior to 5.0.2, update to version 5.0.2 to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-52082

GHSA-RJWV-5J3M-P5X4

Affected Products

Lychee

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52082.json · Exploit
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-rjwv-5j3m-p5x4 · Vendor Advisory
• https://github.com/LycheeOrg/Lychee/commit/33354a2ce7cf700cc4ee537b7b8b94dfc1e84ad4 · Patch
• https://osv.dev/vulnerability/CVE-2023-52082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52082 · Security Note
• https://twitter.com/HunterMapping/status/1740658621061750928 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1740425678518878549 · Twitter Post
• https://twitter.com/CVEnew/status/1740400415269880124 · Twitter Post
• https://twitter.com/zoomeye_team/status/1741092256877302092 · Twitter Post