CVE-2018-6883: SQL Injection
First published: Sat Feb 24 2018(Updated: )
Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Piwigo Piwigo | <2.9.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of this Piwigo issue?
The vulnerability ID of this Piwigo issue is CVE-2018-6883.
What is the title of this Piwigo vulnerability?
The title of this Piwigo vulnerability is 'Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator.'
How severe is this Piwigo vulnerability?
This Piwigo vulnerability has a severity level of medium (4.9).
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by using SQL injection in the tags array parameter of an admin.php?page=tags request in the administration panel of Piwigo, provided they are an administrator.
What is the affected software version of Piwigo?
The affected software version of Piwigo is any version up to and excluding 2.9.3.
Is there a fix available for this Piwigo vulnerability?
Yes, the fix for this Piwigo vulnerability is to upgrade to version 2.9.3 or later.
Where can I find more information about this Piwigo vulnerability?
You can find more information about this Piwigo vulnerability on GitHub (https://github.com/Piwigo/Piwigo/issues/839) and Pastebin (https://pastebin.com/tPebQFy4).
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The Common Weakness Enumeration (CWE) ID for this vulnerability is CWE-89.
- collector/nvd-index
- agent/severity
- agent/author
- agent/weakness
- agent/references
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/piwigo
- canonical/piwigo piwigo