CVE-2017-9426

2018-02-2604:29:00

Google

osv.dev

10 High

AI Score

Confidence

High

0.031 Low

EPSS

Percentile

91.2%

ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action.

CPENameOperatorVersion
piwigo-facetageq0.0.1
piwigo-facetageq0.0.3

CPE	Name	Operator	Version
	piwigo-facetag	eq	0.0.1
	piwigo-facetag	eq	0.0.3

References

touhidshaikh.com/blog/poc/facetag-extension-piwigo-sqli/

www.exploit-db.com/exploits/42094/

www.youtube.com/watch?v=MVCe_zYtFsQ