CVEvulnerability
CVE-2015-2035
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-02-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php.
Affected configurations
• piwigo piwigo (<= 2.7.3)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://packetstormsecurity.com/files/130432/CMS-Piwigo-2.7.3-Cross-Site-Scripting-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://piwigo.org/forum/viewtopic.php?id=25179 Vendor Advisory
- http://piwigo.org/releases/2.7.4 Patch, Release Notes, Vendor Advisory
- http://seclists.org/fulldisclosure/2015/Feb/73 Exploit, Mailing List, Third Party Advisory
- http://sroesemann.blogspot.de/2015/01/sroeadv-2015-06.html Not Applicable
- http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-06.html Not Applicable
- http://www.securityfocus.com/bid/72689 www.securityfocus.com
- http://packetstormsecurity.com/files/130432/CMS-Piwigo-2.7.3-Cross-Site-Scripting-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://piwigo.org/forum/viewtopic.php?id=25179 Vendor Advisory
- http://piwigo.org/releases/2.7.4 Patch, Release Notes, Vendor Advisory
- http://seclists.org/fulldisclosure/2015/Feb/73 Exploit, Mailing List, Third Party Advisory
- http://sroesemann.blogspot.de/2015/01/sroeadv-2015-06.html Not Applicable
- http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-06.html Not Applicable
- http://www.securityfocus.com/bid/72689 www.securityfocus.com