Piwigo up to 2.7.2 Manager admin.php filter_level sql injection

Summaryinfo

A vulnerability marked as critical has been reported in Piwigo up to 2.7.2. The affected element is an unknown function of the file admin.php of the component Manager. The manipulation of the argument filter_level leads to sql injection. This vulnerability is uniquely identified as CVE-2015-1517. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Piwigo up to 2.7.2 (Photo Gallery Software). It has been rated as critical. This issue affects an unknown code of the file admin.php of the component Manager. The manipulation of the argument filter_level with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filter_level parameter in a "Refresh photo set" action in the batch_manager page to admin.php.

The weakness was disclosed 02/20/2015 (Website). It is possible to read the advisory at piwigo.org. The identification of this vulnerability is CVE-2015-1517 since 02/06/2015. The attack may be initiated remotely. A simple authentication is needed for exploitation. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK.

A public exploit has been developed by Sven Schleier and been published even before and not after the advisory. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:admin.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.7.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (36125) and SecurityFocus (BID 72664†). The entries VDB-74268 and VDB-74269 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Photo Gallery Software

Name

• Piwigo

Version

• 2.7.0
• 2.7.1
• 2.7.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion