Piwigo 2.6.0 /picture.php SQL注入漏洞

/include/functionsrate.inc.php if !isset$rate or !$conf'rate' or !inarray$rate, $conf'rateitems' return false; …….. pwgquery$query; $query = ' INSERT INTO '.RATETABLE.' userid,anonymousid,elementid,rate,date VALUES ' .$user'id'.',' .'''.$anonymousid.'',' .$imageid.',' .$rate .',NOW ;';...

[CVE-2015-1517] Piwigo - SQL Injection in Version 2.7.3

CVE-2015-1517 Piwigo - SQL Injection in Version 2.7.3 ---------------------------------------------------------------- Product Information: Software: Piwigo Tested Version: 2.7.3, released on 9 January 2015 Vulnerability Type: SQL Injection CWE-89 Download link: http://piwigo.org/basics/downloads...

Piwigo 'admin.php' SQL Injection Vulnerability

Piwigo is a photo album system based on MySQL5 and PHP5 development. Piwigo 'admin.php' suffers from a SQL injection vulnerability that allows remote attackers to exploit the vulnerability to submit specially crafted SQL queries to manipulate or obtain database data...

Piwigo 'admin.php' Cross-Site Scripting Vulnerability

Piwigo is a photo album script written in PHP. A cross-site scripting vulnerability exists in versions of Piwigo prior to 2.7.4, which allows attackers to launch cross-site scripting attacks...

Piwigo 'admin.php' SQL injection vulnerability (CNVD-2015-01256)

Piwigo is a photo album script written in PHP. A SQL injection vulnerability exists in versions prior to Piwigo 2.7.4 due to the program failing to properly filter user-supplied input before using it in SQL queries. This allows an attacker to access or modify data...

CVE-2015-2035

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...

CVE-2015-2034

Cross-site scripting XSS vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php...

CVE-2015-1517

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filterlevel parameter in a "Refresh photo set" action in the batchmanager page to admin.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php...

Sql injection

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filterlevel parameter in a "Refresh photo set" action in the batchmanager page to admin.php...

Sql injection

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...

CVE-2015-2034

Cross-site scripting XSS vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php...

CVE-2015-1517

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filterlevel parameter in a "Refresh photo set" action in the batchmanager page to admin.php...

CVE-2015-2035

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...

CVE-2015-2035

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...

CVE-2015-2034

Cross-site scripting XSS vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php...

CVE-2015-1517

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filterlevel parameter in a "Refresh photo set" action in the batchmanager page to admin.php...

CVE-2015-2035

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...

CVE-2015-2034

Cross-site scripting XSS vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php...

CVE-2015-2034

Affected software: Piwigo (PHP photo gallery script). Vulnerability: Cross-site scripting (XSS) in the administrative backend. Component/entry point: admin.php via the page parameter. Versions affected: Piwigo before 2.7.4. Root cause/impact: Allows remote attackers to inject arbitrary web script...