Lychee Photo-Management Tool Vulnerable to SQL Injection
CVE-2023-52082

8.8HIGH

Key Information:

Vendor

Lycheeorg

Status
Lychee
Vendor
CVE Published:
28 December 2023

What is CVE-2023-52082?

Prior to version 5.0.2, Lychee, a popular free photo management tool, is susceptible to an SQL injection vulnerability. This issue affects any binding when utilizing MySQL or MariaDB database systems. The vulnerability can be exploited by users who have set the .env configuration options DB_LOG_SQL and DB_LOG_SQL_EXPLAIN to true. It's important to note that the default configurations are secure. Users are advised to upgrade to version 5.0.2 or later to mitigate this risk, or alternatively, disable SQL EXPLAIN logging as a temporary workaround.

Affected Version(s)

Lychee < 5.0.2

References

https://github.com/LycheeOrg/Lychee/security/advisories/G...
x_refsource_CONFIRM
https://github.com/LycheeOrg/Lychee/commit/33354a2ce7cf70...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.