Sql injection

2018-02-2604:29:00

PRIOn knowledge base

www.prio-n.com

8.3 High

AI Score

Confidence

Low

0.031 Low

EPSS

Percentile

91.2%

ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action.

CPENameOperatorVersion
facetageq0.0.3

CPE	Name	Operator	Version
	facetag	eq	0.0.3

References

touhidshaikh.com/blog/poc/facetag-extension-piwigo-sqli/

www.exploit-db.com/exploits/42094/

www.youtube.com/watch?v=MVCe_zYtFsQ