CVE-2017-17824: SQL Injection

Published Dec 21, 2017

Updated

The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batchmanagerunit.php elementids parameter in unit mode. An attacker can exploit this to gain access to the data in a connected MySQL database.

Affected Software

1 affected component

Piwigo piwigo=2.9.2

Remediation

Patch Available

https://github.com/Piwigo/Piwigo/commit/f7c8e0a947a857ff5d31dafd03842df41959b84c

Event History

Dec 21, 2017

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is CVE-2017-17824?

CVE-2017-17824 is a vulnerability in the Batch Manager component of Piwigo 2.9.2 that allows SQL Injection via the admin/batch_manager_unit.php element_ids parameter.

How severe is CVE-2017-17824?

CVE-2017-17824 has a severity rating of 4.9, which is considered medium.

How can an attacker exploit CVE-2017-17824?

An attacker can exploit CVE-2017-17824 by manipulating the element_ids parameter in unit mode of the admin/batch_manager_unit.php file to perform SQL Injection attacks.

What is the affected software version of CVE-2017-17824?

The affected software version of CVE-2017-17824 is Piwigo 2.9.2.

Is there a fix available for CVE-2017-17824?

Yes, a fix for CVE-2017-17824 is available. More information can be found in the provided references.