adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

SQL Injection in the "Users" function of piwigo #1680

New Issue
Closed
opened 2026-10-05 00:52:49 +02:00 by adam · 0 comments
adam commented 2026-10-05 00:52:49 +02:00
Owner
Copy link
Copy source

Access the 'Users' function and use the filter function
image

Observe the request on Burp Suite
image

Manipulate the 'order' or 'exclude[]' parameter by adding a single quote, and an error in MYSQL shows up, proving the existence of SQL injection
image

We can try to retrieve all the databases name with the error-based payload id AND (SELECT 2690 FROM(SELECT COUNT(*),CONCAT(0x716b707671,(SELECT MID((IFNULL(CAST(schema_name AS NCHAR),0x20)),1,51) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),0x7162787071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) , just increasing the LIMIT value to enumerate all the databases name
image

Analyze the vulnerability from the source code, locate the ws_users_getList() function (/piwigo/include/ws_functions/pwg.users.php), notice that 'order' was concat directly after the 'ORDER BY' clause without any kind of input sanitization. The same case happens for
the 'exclude[]' parameter
image

This vulnerability affects the latest version up to 13.7.0, and it is uncertain if other versions will be affected.

Access the 'Users' function and use the filter function ![image](https://github.com/Piwigo/Piwigo/assets/67749472/e2d503b5-096f-4528-97f1-8b9b015cc222) Observe the request on Burp Suite ![image](https://github.com/Piwigo/Piwigo/assets/67749472/7e4280b1-3b93-4c36-9bd3-a03aa1645555) Manipulate the 'order' or 'exclude[]' parameter by adding a single quote, and an error in MYSQL shows up, proving the existence of SQL injection ![image](https://github.com/Piwigo/Piwigo/assets/67749472/ee524c6f-96c5-4c0f-adf2-746a5d58a869) We can try to retrieve all the databases name with the error-based payload `id AND (SELECT 2690 FROM(SELECT COUNT(*),CONCAT(0x716b707671,(SELECT MID((IFNULL(CAST(schema_name AS NCHAR),0x20)),1,51) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),0x7162787071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)` , just increasing the LIMIT value to enumerate all the databases name ![image](https://github.com/Piwigo/Piwigo/assets/67749472/42af1d2b-c9aa-4d96-ad3a-511eecd03349) Analyze the vulnerability from the source code, locate the ws_users_getList() function (/piwigo/include/ws_functions/pwg.users.php), notice that 'order' was concat directly after the 'ORDER BY' clause without any kind of input sanitization. The same case happens for the 'exclude[]' parameter ![image](https://github.com/Piwigo/Piwigo/assets/67749472/4339a86f-c04f-4599-a87d-872bd6fea415) This vulnerability affects the latest version up to 13.7.0, and it is uncertain if other versions will be affected. <!-- github-sync-id:1725285095 -->
adam closed this issue 2026-10-05 00:52:49 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1680