CVE-2021-27973
📋 TL;DR
This SQL injection vulnerability in Piwigo allows attackers to execute arbitrary SQL commands via the language parameter in the admin.php?page=languages endpoint. It affects Piwigo installations before version 11.4.0, potentially compromising database integrity and exposing sensitive information. Administrators with access to the affected admin interface are primarily at risk.
💻 Affected Systems
- Piwigo
📦 What is this software?
Piwigo by Piwigo
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, or remote code execution if database functions allow it.
Likely Case
Unauthorized data access, modification, or deletion of Piwigo database contents including user credentials and site content.
If Mitigated
Limited impact with proper input validation and database permissions restricting query execution scope.
🎯 Exploit Status
Exploitation requires admin authentication but SQL injection payloads are straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.4.0 and later
Vendor Advisory: https://github.com/Piwigo/Piwigo/issues/1352
Restart Required: No
Instructions:
1. Backup your Piwigo installation and database. 2. Download Piwigo 11.4.0 or later from official sources. 3. Replace existing files with new version. 4. Verify functionality post-upgrade.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize language parameter before processing
Modify admin.php to validate language parameter using whitelist approach
Access Restriction
allRestrict access to admin.php endpoint to trusted IP addresses only
Add IP-based restrictions in web server configuration or .htaccess
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns targeting the language parameter
- Restrict database user permissions to minimum required for Piwigo functionality
🔍 How to Verify
Check if Vulnerable:
Check Piwigo version in admin dashboard or by examining piwigo/include/version.php fileCheck Version:
grep 'PHPWG_VERSION' piwigo/include/version.phpVerify Fix Applied:
Confirm version is 11.4.0 or later and test language parameter with SQL injection test payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by admin.php access
- Language parameter containing SQL keywords like UNION, SELECT, INSERT
Network Indicators:
- HTTP requests to admin.php?page=languages with suspicious language parameter values
SIEM Query:
web.url: "*admin.php?page=languages*" AND (web.param.language: "*UNION*" OR web.param.language: "*SELECT*" OR web.param.language: "*INSERT*")