CVE-2023-37270: Piwigo SQL Injection vulnerability in "User-Agent"
First published: Fri Jul 07 2023(Updated: )
Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Piwigo Piwigo | <13.8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491
- https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621
- https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a
- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx
- https://piwigo.org/release-13.8.0
Frequently Asked Questions
What is CVE-2023-37270?
CVE-2023-37270 is a SQL Injection vulnerability in the login of the administrator screen in Piwigo photo gallery software prior to version 13.8.0.
How severe is CVE-2023-37270?
CVE-2023-37270 has a severity rating of 8.8, which is considered high.
What software versions are affected by CVE-2023-37270?
Versions of Piwigo prior to 13.8.0 are affected by CVE-2023-37270.
How can I fix CVE-2023-37270?
To fix CVE-2023-37270, you should update Piwigo to version 13.8.0 or higher.
Where can I find more information about CVE-2023-37270?
You can find more information about CVE-2023-37270 in the references provided: [Link 1](https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491), [Link 2](https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621), [Link 3](https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/severity
- agent/last-modified-date
- agent/author
- agent/title
- agent/remedy
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/piwigo
- canonical/piwigo piwigo