CVE-2023-52082: Lychee is vulnerable to an SQL Injection in explain DB queries.
Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DBLOGSQL=true and DBLOGSQLEXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52082?
CVE-2023-52082 is classified as a high severity vulnerability due to the potential for SQL injection.
How do I fix CVE-2023-52082?
To mitigate CVE-2023-52082, update Lychee to version 5.0.2 or later and ensure that DB_LOG_SQL and DB_LOG_SQL_EXPLAIN settings are disabled.
What versions of Lychee are affected by CVE-2023-52082?
CVE-2023-52082 affects Lychee versions prior to 5.0.2, specifically those from version 4.9.3.
What could happen if CVE-2023-52082 is exploited?
Exploitation of CVE-2023-52082 could allow an attacker to execute arbitrary SQL queries on the database, leading to data breaches or loss.
Who is at risk for CVE-2023-52082?
Users of Lychee who have enabled DB_LOG_SQL and DB_LOG_SQL_EXPLAIN settings are at risk for CVE-2023-52082.