SQL Injection 'may' be possible through filenames #504

New Issue

Closed

opened 2026-10-05 00:01:31 +02:00 by adam · 3 comments

adam commented 2026-10-05 00:01:31 +02:00

Owner

Copy link

Copy source

Hello, I thought I'd let you know of a problem I just encountered.

While my suggestion is a long shot, I had the following set of errors while attempting to do a "Database synchronisation with files: ./galleries/"

Warnings from the program.

[./galleries/all_low/29_Tel_Beit_She'an_(Decapolis)] PWG-UPDATE-1 (wrong filename)
[./galleries/all_low/51_Hezekiah's_Tunnel] PWG-UPDATE-1 (wrong filename)
[./galleries/all_low/73_Pre-Dinner_stop_(Al_Hasa,_Jordan)] PWG-UPDATE-1 (wrong filename)
[./galleries/all_low/Items_From_31_Qasr_El_Yahud_(Jordan_Baptism_Site)] PWG-UPDATE-1 (wrong filename)
[./galleries/all_low/Items_From_31_Qasr_El_Yahud_(Jordan_Baptism_Site)/31_Qasr_El_Yahud_(Jordan_Baptism_Site)] PWG-UPDATE-1 (wrong filename)

The actual SQL Error:

Warning: [mysql error 1064] You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'an_(Decapolis)/2016_09_18_-_Day_06/2016-09-18_20160918_055416.jpg',NULL,'286','1' at line 1084

INSERT  INTO piwigo_images
  (id,file,name,date_available,path,representative_ext,storage_category_id,added_by)
  VALUES('713','2016-09-13_0K3A0165.jpg','2016-09-13 0K3A0165','2016-10-28 15:12:51','./galleries/all_low/00_Transit/2016_09_13_-_Day_01/2016-09-13_0K3A0165.jpg',NULL,'331','1')
  , ('714','2016-09-13_0K3A0167.jpg','2016-09-13 0K3A0167','2016-10-28 15:12:51','./galleries/all_low/00_Transit/2016_09_13_-_Day_01/2016-09-13_0K3A0167.jpg',NULL,'331','1')
  , ('715','2016-09-13_20160913_145837.jpg','2016-09-13 20160913 145837','2016-10-28 15:12:51','./galleries/all_low/00_Transit/2016_09_13_-_Day_01/2016-09-13_20160913_145837.jpg',NULL,'331','1')
  , ('716','2016-09-13_20160913_153852_HDR.jpg','2016-09-13 20160913 153852 HDR','2016-10-28 15:12:51','./galleri in /var/www/html/a_server.com/public_html/israel/gallery/include/dblayer/functions_mysqli.inc.php on line 832

While the DB entry didn't go through because the file had an ' in it as did another prior also, it seems that this isn't being detected early enough, and it still tried to push in through the DB, yet failed. So it seems the query failed, because it there was an error in the structure of the query. My guess is it shouldn't have even got the filename to the query in the first place, or it should have at least been escaped.

Just my thoughts.

Using Piwigo 2.8.2.

Hello, I thought I'd let you know of a problem I just encountered. While my suggestion is a long shot, I had the following set of errors while attempting to do a "Database synchronisation with files: ./galleries/" Warnings from the program. ``` [./galleries/all_low/29_Tel_Beit_She'an_(Decapolis)] PWG-UPDATE-1 (wrong filename) [./galleries/all_low/51_Hezekiah's_Tunnel] PWG-UPDATE-1 (wrong filename) [./galleries/all_low/73_Pre-Dinner_stop_(Al_Hasa,_Jordan)] PWG-UPDATE-1 (wrong filename) [./galleries/all_low/Items_From_31_Qasr_El_Yahud_(Jordan_Baptism_Site)] PWG-UPDATE-1 (wrong filename) [./galleries/all_low/Items_From_31_Qasr_El_Yahud_(Jordan_Baptism_Site)/31_Qasr_El_Yahud_(Jordan_Baptism_Site)] PWG-UPDATE-1 (wrong filename) ``` The actual SQL Error: `Warning: [mysql error 1064] You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'an_(Decapolis)/2016_09_18_-_Day_06/2016-09-18_20160918_055416.jpg',NULL,'286','1' at line 1084` ``` INSERT INTO piwigo_images (id,file,name,date_available,path,representative_ext,storage_category_id,added_by) VALUES('713','2016-09-13_0K3A0165.jpg','2016-09-13 0K3A0165','2016-10-28 15:12:51','./galleries/all_low/00_Transit/2016_09_13_-_Day_01/2016-09-13_0K3A0165.jpg',NULL,'331','1') , ('714','2016-09-13_0K3A0167.jpg','2016-09-13 0K3A0167','2016-10-28 15:12:51','./galleries/all_low/00_Transit/2016_09_13_-_Day_01/2016-09-13_0K3A0167.jpg',NULL,'331','1') , ('715','2016-09-13_20160913_145837.jpg','2016-09-13 20160913 145837','2016-10-28 15:12:51','./galleries/all_low/00_Transit/2016_09_13_-_Day_01/2016-09-13_20160913_145837.jpg',NULL,'331','1') , ('716','2016-09-13_20160913_153852_HDR.jpg','2016-09-13 20160913 153852 HDR','2016-10-28 15:12:51','./galleri in /var/www/html/a_server.com/public_html/israel/gallery/include/dblayer/functions_mysqli.inc.php on line 832 ``` While the DB entry didn't go through because the file had an ' in it as did another prior also, it seems that this isn't being detected early enough, and it still tried to push in through the DB, yet failed. So it seems the query failed, because it there was an error in the structure of the query. My guess is it shouldn't have even got the filename to the query in the first place, or it should have at least been escaped. Just my thoughts. Using Piwigo 2.8.2. <!-- github-sync-id:185836256 -->

adam closed this issue 2026-10-05 00:01:31 +02:00

adam commented 2026-10-05 00:01:32 +02:00

Author

Owner

Copy link

Copy source

As per the screen shot.

As per the screen shot.  <!-- github-comment-id:256833910 -->

adam commented 2026-10-05 00:01:33 +02:00

Author

Owner

Copy link

Copy source

related to #250

related to #250 <!-- github-comment-id:1200120774 -->

adam commented 2026-10-05 00:01:33 +02:00

Author

Owner

Copy link

Copy source

Fixed by https://github.com/Piwigo/Piwigo/commit/e8bef0cf23d1a1549de17f9c9598333bf78bd29f while fixing #250

Fixed by https://github.com/Piwigo/Piwigo/commit/e8bef0cf23d1a1549de17f9c9598333bf78bd29f while fixing #250 <!-- github-comment-id:1243686926 -->

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

issue-2560-people

translation

16.x

feat/embedding-based-contextual-tagging

issue-2576-search-include-ai-in-search-results

feat/search-ocr-ai

issue-2391-update-menu-design

15.x

detect-container

issue-2386-update-filters-users-activity

issue-2362-add-filters-options-in-admin

issue-2367-imagemagick7

issue-2225-quicksearch-help

14.x

issue-2164-BatchManagerUnitMode-Redesign

13.x

12.x

issue-1657-SVG_Support

issue-1703-historySearchMethod

11.x

2.10

2.9

2.8

2.7

2.5

2.6

2.4

2.3

2.2

2.1

2.0

1.7

1.3

1.6

1.5

1.4

16.4.0

16.3.0

16.2.0

16.1.0

16.0.0

16.0.0RC3

16.0.0RC2

15.7.0

16.0.0RC1

16.0.0beta1

16.0.0beta2

15.6.0

15.5.0

15.4.0

15.3.0

15.2.0

15.1.0

15.0.0

15.0.0beta3

15.0.0beta2

15.0.0beta1

14.5.0

14.4.0

14.3.0

14.2.0

14.1.0

14.0.0

14.0.0RC2

14.0.0RC1

14.0.0beta3

14.0.0beta2

13.8.0

14.0.0beta1

13.7.0

13.6.0

13.5.0

13.4.0

13.3.0

13.2.0

13.1.0

13.0.0

13.0.0RC4

13.0.0RC3

13.0.0RC2

13.0.0RC1

12.3.0

13.0.0beta2

13.0.0beta1

12.2.0

12.1.0

12.0.0

12.0.0RC2

12.0.0RC1

12.0.0beta2

12.0.0beta1

11.5.0

11.4.0

11.3.0

11.2.0

11.1.0

11.0.0

11.0.0beta5

2.11.0beta4

2.11.0beta3

2.11.0beta2

2.11.0beta1

2.10.2

2.10.1

2.10.0

2.10.0RC1

2.10.0beta2

2.10.0beta1

2.9.5

2.9.4

2.9.3

2.9.2

2.9.1

2.9.0

2.9.0RC2

2.9.0RC1

2.9.0beta2

2.8.6

2.8.5

2.8.4

2.9.0beta1

2.8.3

2.8.2

2.8.1

2.8.0

2.8.0RC2

2.8.0RC1

2.7.4

2.7.3

2.6.5

2.5.6

2.5.5

2.6.4

2.7.2

2.7.1

2.7.0

2.7.0RC2

2.7.0RC1

2.7.0beta2

2.6.3

2.7.0beta1

2.6.2

2.5.4

2.6.1

2.6.0

2.6.0RC2

2.6.0RC1

2.6.0beta2

2.5.3

2.5.2

2.6.0beta1

2.5.1

2.5.0

2.5.0RC2

2.4.7

2.5.0RC1

2.4.6

2.5.0beta3

2.5.0beta2

2.5.0beta1

2.4.5

2.4.4

2.4.3

2.4.2

2.4.1

2.4.0

2.3.5

2.4.0RC3

2.3.4

2.4.0RC2

2.4.0RC1

2.3.3

2.4.0beta2

2.4.0beta1

2.3.2

2.3.1

2.3.0

2.3.0RC2

2.3.0RC1

2.2.5

2.3.0beta3

2.2.4

2.3.0beta2

2.2.3

2.2.2

2.3.0beta1

2.2.1

2.2.0

2.2.0RC4

2.2.0RC3

2.2.0RC2

2.1.6

2.2.0RC1

2.1.5

2.1.4

2.1.3

2.1.2

2.1.1

2.1.0

2.0.10

2.1.0RC3

2.1.0RC2

2.1.0RC1

2.0.9

2.0.8

2.0.7

2.0.6

2.0.5

2.0.4

2.0.3

2.0.2

2.0.1

2.0.0

2.0.0RC4

1.7.3

2.0.0RC3

2.0.0RC2

2.0.0RC1

1.7.2

1.7.1

1.7.0

1.7.0RC2

1.7.0RC1

1.6.2

1.6.1

1.6.0

1.6.0RC2

1.6.0RC1

1.5.2

1.5.1

1.5.0

1.5.0RC2

1.5.0RC1

1.4.1

1.4.0

1.4.0RC3

1.4.0RC2

1.3.4

1.4.0RC1

1.3.3

1.3.2

1.3.1

1.3.0

1.3.0RC2

1.3.0RC1

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

adam (Adam Wojcieszonek)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/Piwigo#504