SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/172059/Piwigo-13.5.0-SQL-Injection.html | |
| http://seclists.org/fulldisclosure/2023/Apr/13 | |
| https://gist.github.com/rodnt/a190d14d1715890d8df19bad58b90693 | Exploit Third Party Advisory |
| https://piwigo.com | Product |
| https://www.tempest.com.br | Not Applicable |
| http://packetstormsecurity.com/files/172059/Piwigo-13.5.0-SQL-Injection.html | |
| http://seclists.org/fulldisclosure/2023/Apr/13 | |
| https://gist.github.com/rodnt/a190d14d1715890d8df19bad58b90693 | Exploit Third Party Advisory |
| https://piwigo.com | Product |
| https://www.tempest.com.br | Not Applicable |
Configurations
History
21 Nov 2024, 07:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/172059/Piwigo-13.5.0-SQL-Injection.html - | |
| References | () http://seclists.org/fulldisclosure/2023/Apr/13 - | |
| References | () https://gist.github.com/rodnt/a190d14d1715890d8df19bad58b90693 - Exploit, Third Party Advisory | |
| References | () https://piwigo.com - Product | |
| References | () https://www.tempest.com.br - Not Applicable |
Information
Published : 2023-04-21 15:15
Updated : 2024-11-21 07:52
NVD link : CVE-2023-26876
Mitre link : CVE-2023-26876
CVE.ORG link : CVE-2023-26876
JSON object : View
Products Affected
piwigo
- piwigo
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')