adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

I used piwigo14.4 to create a website site that was attacked,SQL database is injected with malicious HTML code #1913

New Issue
Closed
opened 2026-10-05 01:01:02 +02:00 by adam · 3 comments
adam commented 2026-10-05 01:01:02 +02:00
Owner
Copy link
Copy source

Yesterday, August 3, when I logged into my own photo album site using Piwigo version 14.4, the site redirected to other pornographic urls.
I checked the site later and found that malicious people had written malicious HTML code to some fields in my piwigo database.
However, I am not a professional in this field, I do not understand how the attacker wrote my database, I deleted the original site information after the attack, resulting in the imperfect preservation of the attacked information, only leaving these two pictures and the malicious HTML code that the attacker wrote to the SQL database.
1
2
The following line is malicious HTML code that the attacker injected into the field values of my SQL database:
'"\><meta http-equiv="refresh" content="0;url=https://www.highratecpm.com/zjf065d3?key=7d12071e2113ba80d9395f1c5a19b3cf">

I am from China, using the translation software to write this paragraph, there may be some parts of the expression is not correct.
I am sure that I am using piwigo version 14.4, but I did not find any security updates in version 14.5, so I hope to get a reply, whether this problem has been fixed or no one has found or encountered it.

Yesterday, August 3, when I logged into my own photo album site using Piwigo version 14.4, the site redirected to other pornographic urls. I checked the site later and found that malicious people had written malicious HTML code to some fields in my piwigo database. However, I am not a professional in this field, I do not understand how the attacker wrote my database, I deleted the original site information after the attack, resulting in the imperfect preservation of the attacked information, only leaving these two pictures and the malicious HTML code that the attacker wrote to the SQL database. ![1](https://github.com/user-attachments/assets/0a2747f8-4e0a-458d-b653-128736bc4e67) ![2](https://github.com/user-attachments/assets/c544a788-e859-416c-b6d1-89ae3d5e9850) The following line is malicious HTML code that the attacker injected into the field values of my SQL database: ` '"\><meta http-equiv="refresh" content="0;url=https://www.highratecpm.com/zjf065d3?key=7d12071e2113ba80d9395f1c5a19b3cf"> ` I am from China, using the translation software to write this paragraph, there may be some parts of the expression is not correct. I am sure that I am using piwigo version 14.4, but I did not find any security updates in version 14.5, so I hope to get a reply, whether this problem has been fixed or no one has found or encountered it. <!-- github-sync-id:2446449996 -->
adam closed this issue 2026-10-05 01:01:02 +02:00
adam commented 2026-10-05 01:01:03 +02:00
Author
Owner
Copy link
Copy source

Hi @SiverKing

I do not understand how the attacker wrote my database

Same for me. From what I can see, it seems obvious that the change in the database have been made with an SQL query, directly in your database manager. What I mean is that somebody performed an update piwigo_activity set action='malicious HTML'; and I don't see any evidence that they were performed thanks to a vulnerability in Piwigo code. An access to your database manager is enough, whatever the web application using the database.

Hi @SiverKing > I do not understand how the attacker wrote my database Same for me. From what I can see, it seems obvious that the change in the database have been made with an SQL query, directly in your database manager. What I mean is that somebody performed an `update piwigo_activity set action='malicious HTML';` and I don't see any evidence that they were performed thanks to a vulnerability in Piwigo code. An access to your database manager is enough, whatever the web application using the database. <!-- github-comment-id:2276065825 -->
adam commented 2026-10-05 01:01:04 +02:00
Author
Owner
Copy link
Copy source

Hi @plegall
Thanks for replying to me, it doesn't look like a Piwigo bug. It is possible that my database has been leaked by malicious connections, then I will continue to pay attention to whether similar situations occur in the future, and increase the security of my database.

Hi @plegall Thanks for replying to me, it doesn't look like a Piwigo bug. It is possible that my database has been leaked by malicious connections, then I will continue to pay attention to whether similar situations occur in the future, and increase the security of my database. <!-- github-comment-id:2282660360 -->
adam commented 2026-10-05 01:01:05 +02:00
Author
Owner
Copy link
Copy source

I close this issue for now, as long as we have no evidence a bug in Piwigo is the origin of the hack.

I close this issue for now, as long as we have no evidence a bug in Piwigo is the origin of the hack. <!-- github-comment-id:2283500042 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1913