CVE-2023-27233
📋 TL;DR
CVE-2023-27233 is a SQL injection vulnerability in Piwigo's user_list_backend.php file that allows attackers to execute arbitrary SQL commands via the order[0][dir] parameter. This affects all Piwigo installations before version 13.6.0. Attackers could potentially access, modify, or delete database content.
💻 Affected Systems
- Piwigo
📦 What is this software?
Piwigo by Piwigo
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, or remote code execution if database functions allow it.
Likely Case
Unauthorized data access, data manipulation, or authentication bypass leading to administrative access.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploitation requires authentication to access the user_list_backend.php endpoint. The SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.6.0
Vendor Advisory: https://github.com/Piwigo/Piwigo/issues/1872
Restart Required: No
Instructions:
1. Backup your Piwigo installation and database. 2. Download Piwigo 13.6.0 or later from the official website. 3. Replace all files with the new version, preserving your configuration files. 4. Verify the installation works correctly.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the order[0][dir] parameter before processing.
Edit user_list_backend.php to validate/sanitize the order[0][dir] parameter using prepared statements or whitelisting.
Access Restriction
allRestrict access to the vulnerable endpoint to trusted IP addresses only.
Add .htaccess rules or web server configuration to restrict access to user_list_backend.php.
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with SQL injection protection rules.
- Disable or restrict access to the user_list_backend.php file if not needed.
🔍 How to Verify
Check if Vulnerable:
Check if Piwigo version is below 13.6.0 by viewing the admin dashboard or checking the version file.Check Version:
Check the Piwigo admin dashboard or view the content of include/version.inc.phpVerify Fix Applied:
Verify the Piwigo version is 13.6.0 or higher and test the order[0][dir] parameter with SQL injection payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to user_list_backend.php with suspicious order[0][dir] parameters
- Authentication logs showing access to admin functions from unexpected users
Network Indicators:
- HTTP POST/GET requests to user_list_backend.php containing SQL keywords in parameters
- Unusual database connection patterns from the web server
SIEM Query:
source="web_logs" AND uri="*user_list_backend.php*" AND (param="*order[0][dir]*" AND value="*SELECT* OR *UNION* OR *OR* OR *AND*")