CVE-2024-48928

Piwigo 14.x installations are affected by a weakness in the secret_key, set to MD5(RAND()) in MySQL. RAND() provides ~30 bits of entropy, enabling brute-forcing the secret key within about an hour. The CSRF token is partially derived from the secret key, allowing verification of brute-force succe...