high8.8
CVE-2023-26876
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admi…
Impact
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Piwigo | Piwigo | through 13.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/172059/Piwigo-13.5.0-SQL-Injection.html
- http://seclists.org/fulldisclosure/2023/Apr/13
- https://gist.github.com/rodnt/a190d14d1715890d8df19bad58b90693
- https://piwigo.com
- https://www.tempest.com.br
- http://packetstormsecurity.com/files/172059/Piwigo-13.5.0-SQL-Injection.html
- http://seclists.org/fulldisclosure/2023/Apr/13
- https://gist.github.com/rodnt/a190d14d1715890d8df19bad58b90693
- https://piwigo.com
- https://www.tempest.com.br