adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

a SQL injection in version 2.9.2 #728

New Issue
Closed
opened 2026-10-05 00:14:16 +02:00 by adam · 4 comments
adam commented 2026-10-05 00:14:16 +02:00
Owner
Copy link
Copy source

#SQL injection in version 2.9.2

in admin/tags.php

if (isset($_POST['edit_submit']))
{
  $query = 'SELECT name FROM '.TAGS_TABLE.';';
  $existing_names = array_from_query($query, 'name');
  $current_name_of = array();
  $query = '
SELECT id, name
  FROM '.TAGS_TABLE.'
  WHERE id IN ('.$_POST['edit_list'].')
;';


  $result = pwg_query($query);

values of the edit_list parameters are not sanitized;
these are used to construct a SQL query and retrieve a list of registered users into the application.

so post the data

#SQL injection in version 2.9.2 -- in admin/tags.php ``` if (isset($_POST['edit_submit'])) { $query = 'SELECT name FROM '.TAGS_TABLE.';'; $existing_names = array_from_query($query, 'name'); $current_name_of = array(); $query = ' SELECT id, name FROM '.TAGS_TABLE.' WHERE id IN ('.$_POST['edit_list'].') ;'; $result = pwg_query($query); ``` values of the edit_list parameters are not sanitized; these are used to construct a SQL query and retrieve a list of registered users into the application. so post the data ![](http://45.78.24.199/piwigo_sql_post@2x.png) ![](http://45.78.24.199/piwigo_sql_result.png) <!-- github-sync-id:275245468 -->
adam closed this issue 2026-10-05 00:14:16 +02:00
adam commented 2026-10-05 00:14:17 +02:00
Author
Owner
Copy link
Copy source

@uxff there is not Get/Post variable in there
come back with a poc on a new thread

@uxff there is not Get/Post variable in there come back with a poc on a new thread <!-- github-comment-id:362899322 -->
adam commented 2026-10-05 00:14:17 +02:00
Author
Owner
Copy link
Copy source

sorry, the $conf is not from client request.
very sorry.
@flop25

sorry, the $conf is not from client request. very sorry. @flop25 <!-- github-comment-id:362908590 -->
adam commented 2026-10-05 00:14:18 +02:00
Author
Owner
Copy link
Copy source

^^ Ok Have a good day

^^ Ok Have a good day <!-- github-comment-id:362908670 -->
adam commented 2026-10-05 00:14:19 +02:00
Author
Owner
Copy link
Copy source

@plegall so is this false report and CVE should be asked to be rejected or?

@plegall so is this false report and CVE should be asked to be rejected or? <!-- github-comment-id:390565685 -->
adam changed title from a SQL injection in version 2.9.2 to a SQL injection in version 2.9.2 2026-10-27 11:09:50 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#728