CVE-2017-17774

Piwigo version 2.9.2 is vulnerable to Cross-Site Request Forgery (CSRF) via specific URL parameters. An attacker can coerce an admin user into performing unintended actions.

CVE-2017-10681 in Piwigo through 2.9.1 has a CSRF vulnerability that allows remote attackers to hijack user authentication for requests to unlock albums via a crafted request.

CVE-2017-10680 is a CSRF vulnerability in Piwigo through version 2.9.1 that allows remote attackers to hijack user authentication to change a private album to public via a crafted request.

Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed.

The CSRF vulnerability in Piwigo through version 2.9.1 allows remote attackers to hijack user authentication for requests to delete permalinks via a crafted request.

The admin/batch_manager.php file in Piwigo up to version 2.8.3 has a vulnerability that allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka the mode parameter).

SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

SQL injection vulnerability in the rate_picture function in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit.

Unspecified vulnerability in Piwigo before version 2.6.3 has unknown impact and attack vectors, related to a 'security failure.'

A vulnerability in the Piwigo installer versions 16.3.0 and earlier allows PHP code injection via POST parameters for database configuration. Lack of proper input sanitization and bypass of `addslashes()` on PHP 8+ enables an unauthenticated attacker to write malicious code into a configuration file, executed on every page load.