Piwigo admin/user_perm.php SQL Injection Vulnerability

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. Piwigo admin/userperm.php has a SQL injection vulnerability that can be exploited by an attacker to inject it into admin.php via the...

CVE-2020-19215

SQL Injection vulnerability in admin/userperm.php in piwigo v2.9.5, via the catfalse parameter to admin.php?page=userperm...

Sql injection

SQL Injection vulnerability in admin/userperm.php in piwigo v2.9.5, via the catfalse parameter to admin.php?page=groupperm...

Sql injection

SQL Injection vulnerability in admin/userperm.php in piwigo v2.9.5, via the catfalse parameter to admin.php?page=userperm...

CVE-2020-19215

CVE-2020-19215 describes a SQL injection in Piwigo v2.9.5, exploiting the admin/user_perm.php component via the cat_false parameter in admin.php?page=user_perm. The root cause is an injectable input handling within that admin page; impact is partial to high depending on the document’s CVSS data, ...