Piwigo vulnerabilities

Piwigo before version 16.4.0: check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials.

Piwigo before version 16.4.0: admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing the existing sort-field whitelist. The stored album image_order expression is later concatenated into ORDER BY clauses by admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.inc.php, and include/ws_functions/pwg.categories.php. When at least one album contains at least one photo, an authenticated administrator can store a crafted expression and trigger it in a later album or Batch Manager query to disclose, modify, or disrupt database data.

In Piwigo prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, ratio, and filesize values from the Batch Manager filter URL without numeric validation. These values are stored in the bulk_manager_filter session state and concatenated into SQL predicates, allowing an authenticated administrator to inject SQL expressions. The issue is fixed in version 16.4.0.

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, Imagick's support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution. This has been patched in 16.4.0.

Piwigo version 2.9.2 is vulnerable to Cross-Site Request Forgery (CSRF) via specific URL parameters. An attacker can coerce an admin user into performing unintended actions.

The admin/configuration.php file in Piwigo version 2.9.2 has a CSRF (Cross-Site Request Forgery) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.

CVE-2017-10681 in Piwigo through 2.9.1 has a CSRF vulnerability that allows remote attackers to hijack user authentication for requests to unlock albums via a crafted request.

CVE-2017-10680 is a CSRF vulnerability in Piwigo through version 2.9.1 that allows remote attackers to hijack user authentication to change a private album to public via a crafted request.

Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed.

The CSRF vulnerability in Piwigo through version 2.9.1 allows remote attackers to hijack user authentication for requests to delete permalinks via a crafted request.

The admin/batch_manager.php file in Piwigo up to version 2.8.3 has a vulnerability that allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka the mode parameter).

SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

SQL injection vulnerability in the rate_picture function in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit.

Unspecified vulnerability in Piwigo before version 2.6.3 has unknown impact and attack vectors, related to a 'security failure.'

In Piwigo up to version 17.0.0beta1, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and open the returned search URL. The value is not validated and is used as the upper bound in an SQL query, allowing extraction of database information or time delays.

In Piwigo before version 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension in the filename. An authenticated administrator can upload a file with a server-executable extension, leading to code execution when placed in the logo directory.

A vulnerability in the Piwigo installer versions 16.3.0 and earlier allows PHP code injection via POST parameters for database configuration. Lack of proper input sanitization and bypass of `addslashes()` on PHP 8+ enables an unauthenticated attacker to write malicious code into a configuration file, executed on every page load.

Piwigo, an open source photo gallery application, prior to version 16.3.0 contains an SQL injection vulnerability in the date filter. Four date parameters are concatenated directly into SQL without escaping or type validation. An unauthenticated attacker can read the entire database, including user password hashes. The issue is patched in version 16.3.0.

Piwigo version 13.6.0 is vulnerable to SQL Injection in the 'profile' function.

Piwigo version 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.

In Piwigo up to version 2.9.1, there is an SQL injection vulnerability in the administrative backend that allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.

The admin/plugin.php file in Piwigo up to version 2.8.3 does not validate the sections variable when using it to include files. This can lead to information disclosure and code execution if it contains a .. sequence.

A security vulnerability has been detected in Piwigo up to version 16.3.0. It affects some unknown functionality of the file i.php in the Image Derivative Handler component. The manipulation leads to path traversal. Remote exploitation is possible, and the exploit has been publicly disclosed.

A vulnerability has been found in Piwigo 16.3.0 in an unknown function of the Public Authentication Page component. Manipulation of the lang argument leads to cross site scripting. The attack may be performed remotely, but is difficult to exploit. The exploit has been disclosed. Upgrading to version 16.4.0 fixes this issue.

Piwigo prior to version 16.3.0 contains a SQL Injection vulnerability in the Activity List API endpoint. An authenticated administrator can extract sensitive data from the database, including user credentials, email addresses, and all stored content.

Piwigo prior to version 16.3.0 contains a SQL Injection vulnerability in the pwg.users.getList API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands.

In Piwigo prior to version 16.3.0, the pwg.history.search API method is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors.

A cross-site scripting (XSS) vulnerability was found in Piwigo version 14.5.0 in the /admin.php?page=photo component. An attacker can inject malicious JavaScript or HTML into the Description field, leading to arbitrary script execution in the victim's browser.

A cross-site scripting (XSS) vulnerability was found in Piwigo version 14.5.0 in the /admin.php?page=album component. An attacker can inject malicious JavaScript or HTML into the Description field, leading to arbitrary script execution in the victim's browser.

Piwigo version 13.7.0 is vulnerable to SQL Injection via the 'Users' function.

Piwigo version 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the 'add tags' function.