Piwigo 2.6.0 /picture.php SQL注入漏洞

/include/functionsrate.inc.php if !isset$rate or !$conf'rate' or !inarray$rate, $conf'rateitems' return false; …….. pwgquery$query; $query = ' INSERT INTO '.RATETABLE.' userid,anonymousid,elementid,rate,date VALUES ' .$user'id'.',' .'''.$anonymousid.'',' .$imageid.',' .$rate .',NOW ;';...

CVE-2014-9115

SQL injection vulnerability in the ratepicture function in include/functionsrate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a...

CVE-2014-9115

CVE-2014-9115 is a SQL injection vulnerability in Piwigo's rate_picture function (include/functions_rate.inc.php). The issue allows remote attackers to inject arbitrary SQL via the rate parameter to picture.php due to a data type check flaw on a value that begins with a digit. Affected versions i...