piwigo 2.3.3 - Multiple Vulnerabilities

No description provided by source. Advisory ID: HTB23085 Product: Piwigo Vendor: Piwigo project Vulnerable Versions: 2.3.3 and probably prior Tested Version: 2.3.3 Vendor Notification: 4 April 2012 Vendor Patch: 8 April 2012 Public Disclosure: 25 April 2012 Vulnerability Type: Directory Path...

CVE-2014-4649

SQL injection vulnerability in the photo-edit subsystem in Piwigo 2.6.x and 2.7.x before 2.7.0beta2 allows remote authenticated administrators to execute arbitrary SQL commands via the associate field...

CVE-2014-4648

Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure."...

Security feature bypass

Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure."...

Sql injection

SQL injection vulnerability in the photo-edit subsystem in Piwigo 2.6.x and 2.7.x before 2.7.0beta2 allows remote authenticated administrators to execute arbitrary SQL commands via the associate field...

CVE-2014-4649

SQL injection vulnerability in the photo-edit subsystem in Piwigo 2.6.x and 2.7.x before 2.7.0beta2 allows remote authenticated administrators to execute arbitrary SQL commands via the associate field...

CVE-2014-4648

Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure."...

CVE-2014-4648

Technical details about CVE-2014-4648 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2014-4648

Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure."...

CVE-2014-4649

Piwigo contains a SQL injection vulnerability (CVE-2014-4649) in the photo-edit subsystem for versions 2.6.x and 2.7.x prior to 2.7.0beta2. The issue allows remote authenticated administrators to execute arbitrary SQL commands via the associate[] field. Affected software is Piwigo, with the root ...

CVE-2014-4649

SQL injection vulnerability in the photo-edit subsystem in Piwigo 2.6.x and 2.7.x before 2.7.0beta2 allows remote authenticated administrators to execute arbitrary SQL commands via the associate field...

CVE-2014-4648: Undefined Security Weakness

Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure."...

CVE-2014-4649: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the photo-edit subsystem in Piwigo 2.6.x and 2.7.x before 2.7.0beta2 allows remote authenticated administrators to execute arbitrary SQL commands via the associate field...

Piwigo 'ws.php'跨站请求伪造漏洞

Bugtraq ID:65811 Piwigo是一个基于MySQL5与PHP5开发的相册系统。 Piwigo存在一个跨站请求伪造漏洞，允许远程攻击者构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作。 0 Piwigo 2.6.1 目前没有详细解决方案提供： http://it.piwigo.org/ !DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN' html lang="en" head titlePiwigo 2.6.1/title /head body form...

Piwigo 2.6.1 - Cross-Site Request Forgery

Piwigo 2.6.1 - Cross-Site Request Forgery Exploit Title: piwigo 2.6.1 - CSRF Date: 26/02/2014 Exploit Author: [email protected] Vendor Homepage: http://it.piwigo.org/ Software Link: http://it.piwigo.org/basics/downloads Version: 2.6.1 Tested on: Virtualbox debian A CSRF problem is present in the...

Piwigo 2.6.1 Cross Site Request Forgery

Exploit Title: piwigo 2.6.1 - CSRF Date: 26/02/2014 Exploit Author: [email protected] Vendor Homepage: http://it.piwigo.org/ Software Link: http://it.piwigo.org/basics/downloads Version: 2.6.1 Tested on: Virtualbox debian A CSRF problem is present in the administration panel. Here it is a POF...

Piwigo 2.6.1 - Cross-Site Request Forgery

Exploit Title: piwigo 2.6.1 - CSRF Date: 26/02/2014 Exploit Author: [email protected] Vendor Homepage: http://it.piwigo.org/ Software Link: http://it.piwigo.org/basics/downloads Version: 2.6.1 Tested on: Virtualbox debian A CSRF problem is present in the administration panel. Here it is a POF...

Piwigo 2.6.1 - CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: piwigo 2.6.1 - CSRF Date: 26/02/2014 Exploit Author: email protected Vendor Homepage: http://it.piwigo.org/ Software Link: http://it.piwigo.org/basics/downloads Version: 2.6.1 Tested on: Virtualbox debian A CSRF problem is prese...

Piwigo 2.5.3 CMS - Multiple Web Vulnerabilities

Exploit for php platform in category web applications 1 Stored XSS on Multiple parameters click on Add photos http://127.0.0.1/cms/piwigo/admin.php?page=photosadd and click on "create new album" in the album name enter the payload " and save it we can see that our payload gets executed.we can als...

Piwigo - 'admin.php' Cross-Site Request Forgery (User Creation)

source: https://www.securityfocus.com/bid/64357/info Piwigo is prone to cross-site request-forgery and HTML-injection vulnerabilities. Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the...