CVE-2023-33361
📋 TL;DR
Piwigo 13.6.0 contains a SQL injection vulnerability in the /admin/permalinks.php endpoint that allows attackers to execute arbitrary SQL commands. This affects all Piwigo installations running version 13.6.0. Attackers can potentially access, modify, or delete database content.
💻 Affected Systems
- Piwigo
📦 What is this software?
Piwigo by Piwigo
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, or complete system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized database access allowing extraction of sensitive user data, configuration information, or administrative credentials
If Mitigated
Limited impact with proper input validation and WAF rules blocking SQL injection patterns
🎯 Exploit Status
Exploitation requires admin access to reach the vulnerable endpoint
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.6.1
Vendor Advisory: https://github.com/Piwigo/Piwigo/issues/1910
Restart Required: No
Instructions:
1. Backup your Piwigo installation and database. 2. Download Piwigo 13.6.1 or later from the official repository. 3. Replace the vulnerable files with patched versions. 4. Verify the fix by checking the version.
🔧 Temporary Workarounds
Restrict admin access
allLimit access to the admin interface to trusted IP addresses only
# Configure web server to restrict /admin/ path to specific IPs
Disable permalinks module
allTemporarily disable the vulnerable permalinks functionality
# Rename or remove /admin/permalinks.php file
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at application level
- Deploy a web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running Piwigo version 13.6.0 and if /admin/permalinks.php existsCheck Version:
Check Piwigo admin dashboard or examine include/constants.php for version numberVerify Fix Applied:
Verify Piwigo version is 13.6.1 or later and test SQL injection attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin interface
- Requests to /admin/permalinks.php with SQL-like parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) to admin endpoints
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND (uri="/admin/permalinks.php" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR 1=1*"))