Описание
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.
Ссылки
- Patch
- ExploitMitigationVendor Advisory
- Release Notes
- ExploitMitigationVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 16.3.0 (исключая)
cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*
EPSS
Процентиль: 30%
0.00372
Низкий
7.2 High
CVSS3
Дефекты
CWE-89
Связанные уязвимости
CVSS3: 7.2
debian
5 месяцев назад
Piwigo is an open source photo gallery application for the web. Prior ...
EPSS
Процентиль: 30%
0.00372
Низкий
7.2 High
CVSS3
Дефекты
CWE-89