CVE-2023-37270 Piwigo SQL Injection vulnerability in "User-Agent"

High 7.6 Published 7 Jul 2023 Updated 18 Oct 2024

Authenticated users can execute arbitrary SQL via the User-Agent header in Piwigo, potentially leaking database information.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-37270?

CVE-2023-37270 is a high-severity SQL injection vulnerability in Piwigo Piwigo, published on 7 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.

Weakness: CWE-89

Which versions are affected by CVE-2023-37270?

It affects 1 product.

Products include Piwigo Piwigo.

How do I fix CVE-2023-37270?

No fix has been published for CVE-2023-37270 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2023-37270 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37270 exists.

Public exploit code: 1 Nuclei template.

All Piwigo Piwigo vulnerabilities

Sources

Also known as GHSA-934w-qj9p-3qcx.