Description

SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit.

Remediation

References

CVE-2014-9115

Related Vulnerabilities

OpenSSL Out-of-bounds Read Vulnerability (CVE-2016-6306)

Oracle JRE CVE-2020-2803 Vulnerability (CVE-2020-2803)

Phusion Passenger Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-10345)

MySQL CVE-2016-0650 Vulnerability (CVE-2016-0650)

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Security Bypass (1.3.83)

Severity

High

Classification

CVE-2014-9115 CWE-138

Tags

Missing Update Known Vulnerabilities