CVE-2017-17823

The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php order_by array parameter. An attacker can exploit this to gain access to the data in a connected MySQL database.

CVSS v3.0

4.9 MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

EPSS

1.49% chance of exploitation in the next 30 days, 72th percentile

Published

2017-12-21

Updated

2024-08-05

Proof-of-concept exploits (1)

• sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20…

References

• CVE Record
• NVD entry

Related

• CVE-2017-17824
• CVE-2017-17825
• CVE-2017-17826
• CVE-2017-17804
• CVE-2017-17803
• CVE-2017-17802