Summary
Piwigo contains a SQL injection vulnerability in the upgrade authentication flow, where an unauthenticated username may be concatenated directly into a database query on PHP 8 and later.
When database upgrades are pending, a crafted request may bypass administrator authentication, authorize upgrade execution, and cause unauthorized database changes or service disruption.
Affected context
The vulnerability occurs in Piwigo's administrative upgrade workflow when all of the following conditions may apply:
- The application runs on PHP 8 or later.
- Database upgrades are pending.
- The upgrade authentication function processes an attacker-controlled username.
- The username is incorporated into an SQL query without reliable parameterization or escaping.
The risk is concentrated in deployments where the upgrade endpoint is reachable and database accounts permit the affected operations.
Exploit preconditions
- Attack surface: The web-accessible Piwigo database upgrade authentication flow
- Required access: Network access to submit requests; valid administrator credentials are not required
- Trigger point: Processing an attacker-controlled username while checking upgrade authorization
- Required application state: Pending database upgrades and an environment where the legacy escaping check does not protect the input
- Why exploitation is possible: User input is concatenated into an SQL authentication query, allowing query logic to be altered before status and password checks are evaluated
Why this happens
The underlying bug is improper neutralization of special elements in SQL statements, mapped to CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').
The upgrade authentication code conditionally escapes the submitted username based on the presence of the removed get_magic_quotes_gpc function. On PHP 8 and later, that condition does not provide effective protection, allowing the username to reach SQL string construction without dependable parameterization. The resulting query may interpret attacker-controlled content as SQL syntax rather than data.
Potential impact
- An attacker may bypass upgrade authentication.
- Unauthorized database schema or data changes could occur.
- The application may enter an unintended upgrade state.
- Service availability could be disrupted.
- Stored application data or configuration could be altered.
- Database access may provide a foundation for further compromise, depending on privileges.
General mitigation guidance
Mitigation generally focuses on eliminating string-built SQL and reducing the authority of the upgrade path.
Common defensive patterns include:
- Use parameterized queries or prepared statements for every user-controlled value.
- Avoid conditional, legacy escaping logic as a substitute for query parameterization.
- Apply strict server-side validation and allowlists to usernames and other identity fields.
- Require strong administrative authorization through a separately enforced access-control layer before upgrade operations.
- Restrict upgrade endpoints to trusted administrative networks or authenticated maintenance workflows where practical.
- Run the application database account with only the privileges required for normal operation and controlled upgrades.
- Treat upgrade state and authorization checks as separate security decisions rather than relying on query results alone.
How teams detect issues like this
Detection approaches may include:
- Static analysis rules that flag SQL queries assembled through string concatenation with request parameters.
- Code review checks for deprecated escaping APIs, conditional sanitization, and authentication decisions based on dynamic SQL.
- Dynamic testing of upgrade endpoints with malformed identity values and database error monitoring in non-production environments.
- Web application firewall or gateway policies that identify suspicious SQL syntax in upgrade authentication requests.
- Database audit logging for unexpected authentication-query patterns, schema changes, or upgrade actions initiated without a normal administrator session.
- Automated security review tools can help identify direct interpolation of request data into database queries.
