CVE-2017-10682

CRITICAL

Piwigo < 2.9.1 - SQL Injection via cat_false or cat_true Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-10682. PoCs published by Akityo.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Piwigo's administrative backend via the 'cat_false' or 'cat_true' parameter in the comments or status page. The PoC provides a HTTP POST request template to exploit the vulnerability.

Description

SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.

Exploits (1)

exploitdb WORKING POC
by Akityo · textwebappsphp
https://www.exploit-db.com/exploits/43337

This exploit demonstrates a SQL injection vulnerability in Piwigo's administrative backend via the 'cat_false' or 'cat_true' parameter in the comments or status page. The PoC provides a HTTP POST request template to exploit the vulnerability.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Piwigo <= 2.9.1
Auth required
Prerequisites: Access to the administrative backend · Valid session cookie
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://github.com/Piwigo/Piwigo/issues/724
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/99357
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43337/

Scores

CVSS v3 9.8
EPSS 0.0824
EPSS Percentile 94.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
piwigo/piwigo < 2.9.1
Published Jun 29, 2017
Tracked Since Feb 18, 2026