Description

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filter_level parameter in a "Refresh photo set" action in the batch_manager page to admin.php.

Remediation

References

CVE-2015-1517

Related Vulnerabilities

Piwigo Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-10679)

Python Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2022-48566)

Oracle JRE CVE-2013-2414 Vulnerability (CVE-2013-2414)

WordPress Plugin Itinerary Cross-Site Scripting (1.0.0)

Envoy Proxy Improper Certificate Validation Vulnerability (CVE-2022-21654)

Severity

Medium

Classification

CVE-2015-1517 CWE-138

Tags

Missing Update Known Vulnerabilities