Vulnerability CVE-2023-26876
Published: 2023-04-21

Description:
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Piwigo 13.5.0 SQL Injection
Rodolfo Tavares
30.04.2023

Type:

CWE-89

 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

 References:
https://gist.github.com/rodnt/a190d14d1715890d8df19bad58b90693
https://piwigo.com
https://www.tempest.com.br
Copyright 2024, cxsecurity.com

 

Back to Top