Skip to content
Fencer Vulns
high 7.6

CVE-2023-37270 json

Piwigo SQL Injection vulnerability in "User-Agent"

published 2023-07-07 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-41182

cvss
7.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.5%
EPSS 4.5% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known, plus a Nuclei check

Summary

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.

Patch / fix

  • Piwigo Piwigo 13.8.0

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

4.50% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Piwigo 13.7.0 - SQL Injection nuclei detection template
  • github.com https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Piwigo Piwigo

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.