{"api_version":"1","generated_at":"2026-07-23T06:16:14+00:00","cve":"CVE-2014-9115","urls":{"html":"https://cve.report/CVE-2014-9115","api":"https://cve.report/api/cve/CVE-2014-9115.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-9115","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-9115"},"summary":{"title":"CVE-2014-9115","description":"SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-12-23 11:59:04","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://piwigo.org/dev/changeset/30563/trunk/include/functions_rate.inc.php","name":"http://piwigo.org/dev/changeset/30563/trunk/include/functions_rate.inc.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Changeset 30563 for trunk/include/functions_rate.inc.php – piwigo","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://piwigo.org/releases/2.7.2","name":"http://piwigo.org/releases/2.7.2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Piwigo 2.7.2 Release Notes | piwigo.org","mime":"text/html","httpstatus":"400","archivestatus":"200"},{"url":"http://piwigo.org/forum/viewtopic.php?id=24850","name":"http://piwigo.org/forum/viewtopic.php?id=24850","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Piwigo 2.7.2, 2.6.4, 2.5.5, Security Bug Fixed | Piwigo.org","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2014/Nov/23","name":"http://seclists.org/fulldisclosure/2014/Nov/23","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Full Disclosure: Piwigo <= v2.6.0 - Blind SQL Injection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9115","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9115","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"9115","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"piwigo","cpe5":"piwigo","cpe6":"2.6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"9115","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"piwigo","cpe5":"piwigo","cpe6":"2.6.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"9115","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"piwigo","cpe5":"piwigo","cpe6":"2.6.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"9115","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"piwigo","cpe5":"piwigo","cpe6":"2.6.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"9115","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"piwigo","cpe5":"piwigo","cpe6":"2.7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"9115","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"piwigo","cpe5":"piwigo","cpe6":"2.7.0","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"9115","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"piwigo","cpe5":"piwigo","cpe6":"2.7.0","cpe7":"beta2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"9115","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"piwigo","cpe5":"piwigo","cpe6":"2.7.0","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"9115","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"piwigo","cpe5":"piwigo","cpe6":"2.7.0","cpe7":"rc2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"9115","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"piwigo","cpe5":"piwigo","cpe6":"2.7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"9115","vulnerable":"1","versionEndIncluding":"2.5.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"piwigo","cpe5":"piwigo","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:33:13.578Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://piwigo.org/forum/viewtopic.php?id=24850"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://piwigo.org/releases/2.7.2"},{"name":"20141112 Piwigo <= v2.6.0 - Blind SQL Injection","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2014/Nov/23"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://piwigo.org/dev/changeset/30563/trunk/include/functions_rate.inc.php"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-11-12T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-12-23T05:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://piwigo.org/forum/viewtopic.php?id=24850"},{"tags":["x_refsource_CONFIRM"],"url":"http://piwigo.org/releases/2.7.2"},{"name":"20141112 Piwigo <= v2.6.0 - Blind SQL Injection","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2014/Nov/23"},{"tags":["x_refsource_CONFIRM"],"url":"http://piwigo.org/dev/changeset/30563/trunk/include/functions_rate.inc.php"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-9115","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://piwigo.org/forum/viewtopic.php?id=24850","refsource":"CONFIRM","url":"http://piwigo.org/forum/viewtopic.php?id=24850"},{"name":"http://piwigo.org/releases/2.7.2","refsource":"CONFIRM","url":"http://piwigo.org/releases/2.7.2"},{"name":"20141112 Piwigo <= v2.6.0 - Blind SQL Injection","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2014/Nov/23"},{"name":"http://piwigo.org/dev/changeset/30563/trunk/include/functions_rate.inc.php","refsource":"CONFIRM","url":"http://piwigo.org/dev/changeset/30563/trunk/include/functions_rate.inc.php"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-9115","datePublished":"2014-12-23T11:00:00.000Z","dateReserved":"2014-11-26T00:00:00.000Z","dateUpdated":"2024-08-06T13:33:13.578Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-12-23 11:59:04","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*","versionEndIncluding":"2.5.5","matchCriteriaId":"61D5A594-379F-42FF-BC3E-01793AE929FE"},{"vulnerable":true,"criteria":"cpe:2.3:a:piwigo:piwigo:2.6.0:*:*:*:*:*:*:*","matchCriteriaId":"BE8F6745-8E09-4D58-B097-E1C62305B46B"},{"vulnerable":true,"criteria":"cpe:2.3:a:piwigo:piwigo:2.6.1:*:*:*:*:*:*:*","matchCriteriaId":"6CBD76E1-0362-4CFE-A306-CE5F13ADA54B"},{"vulnerable":true,"criteria":"cpe:2.3:a:piwigo:piwigo:2.6.2:*:*:*:*:*:*:*","matchCriteriaId":"B95C9758-4EE5-4690-8EDF-575907C3A15A"},{"vulnerable":true,"criteria":"cpe:2.3:a:piwigo:piwigo:2.6.3:*:*:*:*:*:*:*","matchCriteriaId":"8AE2DA12-FDBC-47DF-AC4A-61581D5941ED"},{"vulnerable":true,"criteria":"cpe:2.3:a:piwigo:piwigo:2.7.0:*:*:*:*:*:*:*","matchCriteriaId":"9088607E-D33B-4058-A816-47981DBB86CC"},{"vulnerable":true,"criteria":"cpe:2.3:a:piwigo:piwigo:2.7.0:beta1:*:*:*:*:*:*","matchCriteriaId":"533214A7-83F9-49E1-BF53-DA53E5AE2F82"},{"vulnerable":true,"criteria":"cpe:2.3:a:piwigo:piwigo:2.7.0:beta2:*:*:*:*:*:*","matchCriteriaId":"92705F58-8812-43D0-A35E-5695A60BBD0A"},{"vulnerable":true,"criteria":"cpe:2.3:a:piwigo:piwigo:2.7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"BBB74696-421F-4414-BB75-996107E2A12B"},{"vulnerable":true,"criteria":"cpe:2.3:a:piwigo:piwigo:2.7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"41B4D40F-2571-4729-BBF6-1014C7A3DC0C"},{"vulnerable":true,"criteria":"cpe:2.3:a:piwigo:piwigo:2.7.1:*:*:*:*:*:*:*","matchCriteriaId":"5C68DAF3-6C49-438A-881B-A261B267C55A"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"9115","Ordinal":"1","Title":"CVE-2014-9115","CVE":"CVE-2014-9115","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"9115","Ordinal":"1","NoteData":"SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit.","Type":"Description","Title":"CVE-2014-9115"},{"CveYear":"2014","CveId":"9115","Ordinal":"2","NoteData":"2014-12-23","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"9115","Ordinal":"3","NoteData":"2014-12-23","Type":"Other","Title":"Modified"}]}}}