Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing the existing sort-field whitelist. The stored album image_order expression is later concatenated into ORDER BY clauses by admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.inc.php, and include/ws_functions/pwg.categories.php.
When at least one album contains at least one photo, an authenticated administrator can store a crafted expression and trigger it in a later album or Batch Manager query to disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/Piwigo/Piwigo/commit/ba1f803f8cefd3602ccb9c6f0155cd529510288a
security-advisories@github.com
https://github.com/Piwigo/Piwigo/commit/ef9e65386d76f9c85f1e23a45dd7af14a5b73a47
security-advisories@github.com
https://github.com/Piwigo/Piwigo/releases/tag/16.4.0
security-advisories@github.com
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-jhp4-7f82-8f6q
security-advisories@github.com