SQL Injection Vulnerability in Piwigo Image Gallery Software
CVE-2020-19215

8.8HIGH

Key Information:

Vendor

Piwigo

Status
Piwigo
Vendor
CVE Published:
6 May 2022

What is CVE-2020-19215?

An SQL Injection vulnerability exists in the admin/user_perm.php script of Piwigo v2.9.5. This issue is triggered via the 'cat_false' parameter when accessed through the admin.php interface. Exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access or modification of the database. It is crucial for users of Piwigo to apply security patches or update their software to mitigate this risk.

References

https://github.com/Piwigo/Piwigo/issues/1011
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.