CVE-2023-37270

HIGHNuclei

Piwigo SQL Injection vulnerability in "User-Agent"

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-37270 has a selected CVSS score of 7.6 (high); EIP currently links 1 Nuclei template.

Description

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 18, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Piwigo

Browse Piwigo / Piwigo

Default status: unknown

CVE List< 13.8.0affected
Before 13.8.0affected

Nuclei templates

1
ProjectDiscoveryHIGHPiwigo 13.7.0 - SQL InjectionCVSS 8.8

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.

Remediation

Upgrade to a patched version of Piwigo or apply the necessary security patches provided by the vendor.

WeaknessesCWE-89
Authorsritikchaddha
Template tagscve2023cvepiwigosqliauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:540706145
FOFA: icon_hash=540706145
FOFA: title="piwigo"
Google: powered by piwigo
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx https://nvd.nist.gov/vuln/detail/CVE-2023-27524 https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491 https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621 https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a

Source: ProjectDiscovery

References

5