CVEvulnerability
CVE-2014-9115
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-12-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit.
Affected configurations
• piwigo piwigo (<= 2.5.5)
• piwigo piwigo 2.6.0
• piwigo piwigo 2.6.1
• piwigo piwigo 2.6.2
• piwigo piwigo 2.6.3
• piwigo piwigo 2.7.0
• piwigo piwigo 2.7.1
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://piwigo.org/dev/changeset/30563/trunk/include/functions_rate.inc.php piwigo.org
- http://piwigo.org/forum/viewtopic.php?id=24850 Vendor Advisory
- http://piwigo.org/releases/2.7.2 Patch
- http://seclists.org/fulldisclosure/2014/Nov/23 Exploit
- http://piwigo.org/dev/changeset/30563/trunk/include/functions_rate.inc.php piwigo.org
- http://piwigo.org/forum/viewtopic.php?id=24850 Vendor Advisory
- http://piwigo.org/releases/2.7.2 Patch
- http://seclists.org/fulldisclosure/2014/Nov/23 Exploit