Summary
Piwigo versions before 16.4.0 may store administrator-controlled album sorting expressions without applying the existing sort-field allowlist. An authenticated administrator can later cause the expression to be used in database queries, potentially disclosing, modifying, or disrupting database data when albums contain photos.
Affected context
The vulnerability occurs in Piwigo's album image-order management and query-building paths when administrator-supplied image_order[] values are persisted without the expected sort-field restrictions. The stored value may later be incorporated into ORDER BY clauses used by album and Batch Manager functionality. Exploitability depends on authenticated administrative access, a populated album, and a later query path that processes the stored ordering expression.
Exploit preconditions
- Attack surface: Administrative album sorting and subsequent album or Batch Manager database queries
- Required access: Authenticated administrator privileges sufficient to set album image-order values
- Trigger point: A later query that incorporates the stored ordering expression into an
ORDER BYclause - Environmental condition: At least one album must contain at least one photo for the relevant query path to be reached
- Why exploitation is possible: Administrator-controlled input is stored without the existing sort-field allowlist and is later concatenated into SQL construction
Why this happens
The underlying bug is improper neutralization of administrator-controlled input before it is incorporated into SQL query text. Piwigo accepts an image-order expression without enforcing the intended whitelist, persists that value, and later concatenates it into ORDER BY clauses across multiple database access paths. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, because data intended to represent a constrained sort option can instead influence SQL statement structure.
Potential impact
- An attacker may disclose database contents accessible to the affected queries
- An attacker could modify or corrupt database data, depending on database permissions
- Database queries may be disrupted, causing administrative or gallery functionality to fail
- Sensitive application or user information may be exposed
- The integrity of album metadata and other stored application data may be affected
General mitigation guidance
Mitigation generally focuses on preserving a strict separation between sortable fields and SQL syntax.
Common defensive patterns include:
- Enforcing a server-side allowlist of permitted sort fields and directions
- Mapping accepted sort identifiers to fixed SQL fragments rather than accepting expressions
- Avoiding string concatenation for user-controlled query components
- Applying parameterized queries where values are involved, while handling identifiers through controlled mappings
- Validating persisted values again at every query boundary
- Restricting administrative privileges and database account permissions to the minimum required
- Treating stored administrator-controlled values as untrusted when they are read back
How teams detect issues like this
Organizations can detect similar issues through:
- Static analysis rules for concatenation of request or persisted values into SQL clauses
- Code review checks covering dynamic
ORDER BY,GROUP BY, table, and column construction - Tests that verify sort parameters are limited to an explicit server-side allowlist
- Database activity monitoring for unexpected query structures or unusual administrative access patterns
- Policy enforcement requiring parameterized queries or approved identifier-mapping helpers
- Automated security review tools that flag untrusted data reaching database query construction
