CVE-2023-37270
📋 TL;DR
Piwigo photo gallery software versions before 13.8.0 contain a SQL injection vulnerability in the administrator login screen. Attackers with any administrator access can execute arbitrary SQL statements by manipulating the User-Agent HTTP header, potentially leading to database information disclosure. This affects all Piwigo installations with administrator accounts.
💻 Affected Systems
- Piwigo
📦 What is this software?
Piwigo by Piwigo
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of sensitive data, user credentials, and potential privilege escalation to full system access.
Likely Case
Database information leakage including user data, configuration details, and potentially hashed passwords.
If Mitigated
No impact if patched or proper input validation is implemented.
🎯 Exploit Status
Exploitation requires administrator credentials but SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.8.0
Vendor Advisory: https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx
Restart Required: No
Instructions:
1. Backup your Piwigo installation and database. 2. Download Piwigo 13.8.0 or later from piwigo.org. 3. Replace existing files with new version. 4. Verify functionality.
🔧 Temporary Workarounds
Input Validation for User-Agent
allImplement proper input escaping for User-Agent header in login functions
Modify include/dblayer/functions_mysqli.inc.php and include/functions.inc.php to escape User-Agent parameter
🧯 If You Can't Patch
- Restrict administrator account access to trusted users only
- Implement web application firewall rules to detect SQL injection patterns in User-Agent headers
🔍 How to Verify
Check if Vulnerable:
Check Piwigo version in admin dashboard or via include/version.php fileCheck Version:
grep 'PHPWG_VERSION' include/version.phpVerify Fix Applied:
Confirm version is 13.8.0 or later and review the patched files in GitHub commit📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Suspicious User-Agent strings containing SQL keywords
Network Indicators:
- HTTP requests with SQL injection patterns in User-Agent header to admin login endpoint
SIEM Query:
source="web_logs" AND (User-Agent CONTAINS "UNION" OR User-Agent CONTAINS "SELECT" OR User-Agent CONTAINS "INSERT") AND uri="/admin.php"🔗 References
- https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491
- https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621
- https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a
- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx
- https://piwigo.org/release-13.8.0
- https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491
- https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621
- https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a
- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx
- https://piwigo.org/release-13.8.0
