CVE-2017-9426
📋 TL;DR
CVE-2017-9426 is a critical SQL injection vulnerability in the Facetag extension for Piwigo. It allows attackers to execute arbitrary SQL commands via the imageId parameter in specific actions, potentially compromising the entire database. Any Piwigo installation using Facetag extension version 0.0.3 is affected.
💻 Affected Systems
- Piwigo Facetag Extension
📦 What is this software?
Facetag by Facetag Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, privilege escalation, and potential remote code execution on the underlying server.
Likely Case
Database information disclosure, including user credentials, sensitive content, and potential administrative access to the Piwigo installation.
If Mitigated
Limited impact with proper input validation and database permission restrictions, though SQL injection could still expose some data.
🎯 Exploit Status
Multiple public proof-of-concept exploits exist, including detailed write-ups and demonstration videos. Exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
1. Remove the Facetag extension completely from your Piwigo installation. 2. Delete the facetag directory from piwigo/plugins/. 3. Consider using alternative tagging extensions that are maintained and secure.
🔧 Temporary Workarounds
Disable Facetag Extension
linuxTemporarily disable the vulnerable extension while maintaining Piwigo functionality
mv /path/to/piwigo/plugins/facetag /path/to/piwigo/plugins/facetag.disabled
Input Validation Filter
allAdd input validation to ws.php to sanitize imageId parameter
Edit ws.php and add: if(!is_numeric($_POST['imageId'])) { die('Invalid input'); }
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns targeting the facetag.changeTag and facetag.listTags actions
- Restrict database user permissions to read-only for the Piwigo application database
🔍 How to Verify
Check if Vulnerable:
Check if /path/to/piwigo/plugins/facetag/ws.php exists and contains version 0.0.3 in file headers or extension metadataCheck Version:
grep -r 'version.*0.0.3' /path/to/piwigo/plugins/facetag/Verify Fix Applied:
Confirm facetag directory is removed or renamed, and ws.php is no longer accessible via web requests📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to */ws.php with facetag.changeTag or facetag.listTags actions containing unusual imageId parameters
- Database error logs showing SQL syntax errors from Piwigo application
Network Indicators:
- POST requests with SQL injection payloads in imageId parameter
- Unusual database query patterns from web server IP
SIEM Query:
source="web_access_logs" AND uri="*ws.php*" AND (action="facetag.changeTag" OR action="facetag.listTags") AND imageId="*' OR *"🔗 References
- http://touhidshaikh.com/blog/poc/facetag-extension-piwigo-sqli/
- https://www.exploit-db.com/exploits/42094/
- https://www.youtube.com/watch?v=MVCe_zYtFsQ
- http://touhidshaikh.com/blog/poc/facetag-extension-piwigo-sqli/
- https://www.exploit-db.com/exploits/42094/
- https://www.youtube.com/watch?v=MVCe_zYtFsQ
