Description

SQL injection vulnerability in the photo-edit subsystem in Piwigo 2.6.x and 2.7.x before 2.7.0beta2 allows remote authenticated administrators to execute arbitrary SQL commands via the associate[] field.

Remediation

References

CVE-2014-4649

Related Vulnerabilities

Drupal Core 9.4.x Cross-Site Scripting (9.4.0 - 9.4.2)

Apache HTTP Server CVE-2003-0789 Vulnerability (CVE-2003-0789)

Vanilla Forums Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-10073)

Drupal Core 8.x.x Remote Code Execution (8.0.0 - 8.7.14)

ownCloud Credentials Management Errors Vulnerability (CVE-2012-5607)

Severity

Medium

Classification

CVE-2014-4649 CWE-138

Tags

Missing Update Known Vulnerabilities