CVE-2017-10682

Critical

Published: 29/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Piwigo up to version 2.9.1, there is an SQL injection vulnerability in the administrative backend that allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.

Risk Assessment

This vulnerability could lead to unauthorized access to the database and exposure of sensitive information, posing a serious threat to the organization's security.

Recommendation

It is recommended to update Piwigo to the latest version to eliminate this vulnerability and implement additional security measures such as input data filtering.

Original NVD description (English source)

SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.