adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

The new version is broken frontend - MySQL sending query - request to parameter (no_photo_yet) vulnerability #1239

New Issue
Closed
opened 2026-10-05 00:37:12 +02:00 by adam · 4 comments
adam commented 2026-10-05 00:37:12 +02:00
Owner
Copy link
Copy source

Dear friend, please fix your query request to your parameter (no_photo_yet), from outside!
This could be a serious vulnerability!
proof: https://streamable.com/nek9tf and https://www.nu11secur1ty.com/2021/05/cve-2021-32615-new-vesion-broken.html
KR @nu11secur1ty

Dear friend, please fix your query request to your parameter (no_photo_yet), from outside! This could be a serious vulnerability! proof: https://streamable.com/nek9tf and https://www.nu11secur1ty.com/2021/05/cve-2021-32615-new-vesion-broken.html KR @nu11secur1ty <!-- github-sync-id:907471790 -->
adam closed this issue 2026-10-05 00:37:13 +02:00
adam commented 2026-10-05 00:37:14 +02:00
Author
Owner
Copy link
Copy source

Hi,

I've seen the video and yet I don't understand what you did. I see there is a problem with the theme loaded, but that's not such a big deal (not a security issue as far as I can see). So please give us more details :-)

Hi, I've seen the video and yet I don't understand what you did. I see there is a problem with the theme loaded, but that's not such a big deal (not a security issue as far as I can see). So please give us more details :-) <!-- github-comment-id:851496017 -->
adam commented 2026-10-05 00:37:14 +02:00
Author
Owner
Copy link
Copy source

Hello,
I agree: you demonstrated that the "not photo yet" screen can be bypassed. And that's totally intended. That page is a landing page, which can be skipped to access to the public gallery.

What you seem to do:
-log as admin on "not photo yet" screen
-logout
-use a perl script to access to the url "?no_photo_yet=browse" (?!)
-log as admin on the menubar
-get lost in your tabs?
-logout
-drop all tables
-import them
-go back to the "not photo yet" screen and again the pubic gallery

At which step do we actually see that you used the GET parameter no_photo_yet to insert Mysql content?

Hello, I agree: you demonstrated that the "not photo yet" screen can be bypassed. And that's totally intended. That page is a landing page, which can be skipped to access to the public gallery. What you seem to do: -log as admin on "not photo yet" screen -logout -use a perl script to access to the url "?no_photo_yet=browse" (?!) -log as admin on the menubar -get lost in your tabs? -logout -drop all tables -import them -go back to the "not photo yet" screen and again the pubic gallery At which step do we actually see that you used the GET parameter no_photo_yet to insert Mysql content? <!-- github-comment-id:851556274 -->
adam commented 2026-10-05 00:37:15 +02:00
Author
Owner
Copy link
Copy source

You have a broken query, and I've dropped all tables because I have a lot of work.

  1. When someone clicks from outside on the button of your login form which is "... or browse your empty gallery" he will send a request to your broken query and your broken query is destroying your frontend at all.
  2. If this is normal I can not believe it. :D BR proof: https://streamable.com/sjqrhu
You have a broken query, and I've dropped all tables because I have a lot of work. 1. When someone clicks from outside on the button of your login form which is "... or browse your empty gallery" he will send a request to your broken query and your broken query is destroying your frontend at all. 2. If this is normal I can not believe it. :D BR proof: https://streamable.com/sjqrhu <!-- github-comment-id:851574280 -->
adam commented 2026-10-05 00:37:16 +02:00
Author
Owner
Copy link
Copy source

Hi,

I've seen the video and yet I don't understand what you did. I see there is a problem with the theme loaded, but that's not such a big deal (not a security issue as far as I can see). So please give us more details :-)

Yea now is not security issue, but after will be :) So, dear friends, please fix it.
KR

> Hi, > > I've seen the video and yet I don't understand what you did. I see there is a problem with the theme loaded, but that's not such a big deal (not a security issue as far as I can see). So please give us more details :-) Yea now is not security issue, but after will be :) So, dear friends, please fix it. KR <!-- github-comment-id:851579154 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1239