CVE-2024-43018: SQL Injection
Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters maxlevel and minregister. These parameters are used in wsusergerList function from file include\wsfunctions\pwg.users.php and this same function is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=userlist.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43018?
CVE-2024-43018 is classified as a critical SQL Injection vulnerability that can compromise user data.
How do I fix CVE-2024-43018?
To fix CVE-2024-43018, upgrade Piwigo to version 13.8.1 or later as this version contains the necessary security patches.
What software is affected by CVE-2024-43018?
CVE-2024-43018 affects Piwigo version 13.8.0 and earlier.
What are the potential impacts of CVE-2024-43018?
The potential impacts of CVE-2024-43018 include unauthorized access to the database and exposure of sensitive user information.
How does CVE-2024-43018 exploit SQL Injection?
CVE-2024-43018 exploits SQL Injection through the parameters max_level and min_register in the ws_user_gerList function.