CVE-2014-9115: SQL Injection

Q: What is the severity of CVE-2014-9115?

CVE-2014-9115 is classified as a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary SQL commands.

Q: How do I fix CVE-2014-9115?

To fix CVE-2014-9115, upgrade to Piwigo version 2.7.2 or later.

Q: Which versions of Piwigo are affected by CVE-2014-9115?

CVE-2014-9115 affects Piwigo versions before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2.

Q: Is there a workaround for CVE-2014-9115?

There is no official workaround for CVE-2014-9115; the recommended action is to update to the latest version.

Q: Can CVE-2014-9115 lead to data loss?

Yes, CVE-2014-9115 can potentially lead to data loss as it allows attackers to execute arbitrary SQL commands.

Published Dec 23, 2014

Updated

SQL injection vulnerability in the ratepicture function in include/functionsrate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit.

Affected Software

11 affected components

Piwigo piwigo<=2.5.5

Piwigo piwigo=2.6.0

Piwigo piwigo=2.6.1

Piwigo piwigo=2.6.2

Piwigo piwigo=2.6.3

Piwigo piwigo=2.7.0

Piwigo piwigo=2.7.0-beta1

Piwigo piwigo=2.7.0-beta2

Piwigo piwigo=2.7.0-rc1

Piwigo piwigo=2.7.0-rc2

Piwigo piwigo=2.7.1

Remediation

Patch Available

http://piwigo.org/releases/2.7.2

Event History

Dec 23, 2014

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9115?

CVE-2014-9115 is classified as a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary SQL commands.

How do I fix CVE-2014-9115?