CVE-2018-6883: SQL Injection
Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this Piwigo issue?
The vulnerability ID of this Piwigo issue is CVE-2018-6883.
What is the title of this Piwigo vulnerability?
The title of this Piwigo vulnerability is 'Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator.'
How severe is this Piwigo vulnerability?
This Piwigo vulnerability has a severity level of medium (4.9).
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by using SQL injection in the tags array parameter of an admin.php?page=tags request in the administration panel of Piwigo, provided they are an administrator.
What is the affected software version of Piwigo?
The affected software version of Piwigo is any version up to and excluding 2.9.3.
Is there a fix available for this Piwigo vulnerability?
Yes, the fix for this Piwigo vulnerability is to upgrade to version 2.9.3 or later.
Where can I find more information about this Piwigo vulnerability?
You can find more information about this Piwigo vulnerability on GitHub (https://github.com/Piwigo/Piwigo/issues/839) and Pastebin (https://pastebin.com/tPebQFy4).
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The Common Weakness Enumeration (CWE) ID for this vulnerability is CWE-89.