SQL Injection Vulnerability in Piwigo by Piwigo
CVE-2020-19217

8.8HIGH

Key Information:

Vendor

Piwigo

Status
Piwigo
Vendor
CVE Published:
6 May 2022

What is CVE-2020-19217?

A vulnerability exists in the Piwigo application, specifically in the file admin/batch_manager.php, where an SQL Injection can be exploited via the filter_category parameter in admin.php?page=batch_manager. This issue can allow an attacker to interfere with the application's database queries, potentially leading to unauthorized access to sensitive data.

References

https://github.com/Piwigo/Piwigo/issues/1012
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.