Piwigo 'admin.php' SQL Injection Vulnerability
BID:72689
Info
Piwigo 'admin.php' SQL Injection Vulnerability
| Bugtraq ID: | 72689 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-2035 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 18 2015 12:00AM |
| Updated: | Feb 18 2015 12:00AM |
| Credit: | Steffen Rösemann |
| Vulnerable: |
Piwigo Piwigo 2.7.3 Piwigo Piwigo 2.7.2 Piwigo Piwigo 2.6.3 Piwigo Piwigo 2.6.1 Piwigo Piwigo 2.5.2 Piwigo Piwigo 2.4.7 Piwigo Piwigo 2.4.6 Piwigo Piwigo 2.4.5 Piwigo Piwigo 2.4.4 Piwigo Piwigo 2.4.3 Piwigo Piwigo 2.3.4 Piwigo Piwigo 2.3.3 Piwigo Piwigo 2.3.2 Piwigo Piwigo 2.1.3 Piwigo Piwigo 2.1.2 Piwigo Piwigo 2.0.9 Piwigo Piwigo 2.0.8 Piwigo Piwigo 2.0.7 Piwigo Piwigo 2.0.6 Piwigo Piwigo 2.0.5 Piwigo Piwigo 2.0.3 Piwigo Piwigo 2.0 Piwigo Piwigo 2.7.1 Piwigo Piwigo 2.6.4 Piwigo Piwigo 2.6.2 Piwigo Piwigo 2.6.0 Piwigo Piwigo 2.5.5 Piwigo Piwigo 2.5.3 Piwigo Piwigo 2.5.0 Piwigo Piwigo 2.4.2 Piwigo Piwigo 2.4.1 Piwigo Piwigo 2.4.0 Piwigo Piwigo 2.3.5 Piwigo Piwigo 2.3.1 Piwigo Piwigo 2.3.0 Piwigo Piwigo 2.2.5 Piwigo Piwigo 2.2.4 Piwigo Piwigo 2.2.3 Piwigo Piwigo 2.2.2 Piwigo Piwigo 2.2.1 Piwigo Piwigo 2.2.0 Piwigo Piwigo 2.1.6 Piwigo Piwigo 2.1.5 Piwigo Piwigo 2.1.4 Piwigo Piwigo 2.1.1 Piwigo Piwigo 2.1.0 Piwigo Piwigo 2.0.4 Piwigo Piwigo 2.0.2 Piwigo Piwigo 2.0.10 Piwigo Piwigo 2.0.1 Piwigo Piwigo 1.7.3 Piwigo Piwigo 1.7.2 Piwigo Piwigo 1.7.1 Piwigo Piwigo 1.7.0 Piwigo Piwigo 1.6.2 Piwigo Piwigo 1.6.1 Piwigo Piwigo 1.6.0 Piwigo Piwigo 1.5.2 Piwigo Piwigo 1.5.1 Piwigo Piwigo 1.5.0 Piwigo Piwigo 1.4.1 Piwigo Piwigo 1.4.0 Piwigo Piwigo 1.3.4 Piwigo Piwigo 1.3.3 Piwigo Piwigo 1.3.2 Piwigo Piwigo 1.3.1 Piwigo Piwigo 1.3.0 Piwigo Piwigo 1.2.1 Piwigo Piwigo 1.2.0 Piwigo Piwigo 1.1.0 Piwigo Piwigo 1.0.2 Piwigo Piwigo 1.0.1 |
| Not Vulnerable: |
Piwigo Piwigo 2.7.4 |
Discussion
Piwigo 'admin.php' SQL Injection Vulnerability
Piwigo is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Piwigo 2.7.3 and prior versions are vulnerable.
Piwigo is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Piwigo 2.7.3 and prior versions are vulnerable.
Exploit / POC
Piwigo 'admin.php' SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
Piwigo 'admin.php' SQL Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.