Piwigo 13.6.0 suffers from a SQL Injection vulnerability identified as CVE-2023-33362. The flaw exists in the admin.php page, specifically in the handling of the 'user_id' parameter within the 'profile' admin page. An authenticated administrator can exploit this by sending a crafted HTTP GET request containing SQL code that alters the intended query logic, such as 'user_id=' OR 1=1 --', which effectively bypasses normal query constraints. This injection can lead to unauthorized data disclosure, modification, or potentially full database compromise depending on the backend database privileges. The vulnerability arises from insufficient input sanitization and lack of parameterized queries in the affected code path. The exploit was tested on Windows but is applicable to any environment running the vulnerable Piwigo version. Although no public exploit kits or widespread attacks are currently reported, the availability of proof-of-concept code lowers the barrier for attackers. The vulnerability requires admin-level authentication, limiting exposure to insiders or compromised admin accounts. However, given Piwigo’s use in managing photo galleries and digital assets, sensitive personal or organizational data could be at risk. The lack of official patches or updates at the time of reporting necessitates immediate mitigation efforts. Organizations should audit their Piwigo installations, restrict admin access, and monitor for suspicious activity. Applying web application firewall (WAF) rules to detect SQL injection patterns and reviewing source code for secure query handling are recommended. This vulnerability highlights the importance of secure coding practices and timely patch management in open-source web applications.

For European organizations, this SQL Injection vulnerability poses a significant risk to confidentiality and integrity of data managed within Piwigo installations. Organizations using Piwigo to store or manage sensitive images, personal data, or intellectual property could face data breaches or unauthorized data manipulation. The requirement for admin authentication reduces the risk of external attackers but raises concerns about insider threats or compromised admin credentials. Exploitation could lead to data leakage, defacement, or further lateral movement within the network. Given the widespread use of open-source CMS and digital asset management tools in sectors such as media, education, and government across Europe, the impact could be substantial if exploited. Additionally, GDPR compliance implications arise if personal data is exposed. The vulnerability could disrupt business operations and damage organizational reputation. The medium severity rating reflects the balance between the need for authentication and the potential damage from exploitation.

1. Immediately restrict admin access to trusted personnel and enforce strong authentication mechanisms such as multi-factor authentication (MFA). 2. Monitor and audit admin activity logs for unusual or unauthorized access patterns. 3. Apply input validation and sanitization on all user-supplied parameters, especially 'user_id' in admin.php, using parameterized queries or prepared statements to prevent SQL injection. 4. Deploy a Web Application Firewall (WAF) with rules specifically targeting SQL injection patterns to detect and block malicious requests. 5. Regularly update Piwigo installations to the latest versions once patches addressing this vulnerability are released. 6. Conduct code reviews and security testing on custom plugins or modifications to ensure no similar injection flaws exist. 7. Isolate Piwigo servers within segmented network zones to limit lateral movement in case of compromise. 8. Educate administrators on phishing and credential security to reduce risk of account compromise. 9. Backup databases regularly and verify integrity to enable recovery in case of data tampering. 10. Engage in threat hunting for indicators of compromise related to this vulnerability.