Piwigo Photo Gallery SQL Injection Vulnerability

Piwigo, a full featured open source photo gallery application for the web, is affected by a SQL injection vulnerability in versions 17.0.0beta1 and earlier.

When rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. The unvalidated value is stored in the search rules, and include/functions_search.inc.php integer-casts only the lower rating bound while concatenating the raw value as the SQL upper bound.

• Affected versions: 17.0.0beta1 and earlier
• Attack vector: unauthenticated guest through the public search flow
• Impact: error-based or blind extraction of database information and database-dependent time delays
• No fixed version is available as of this review