CVE-2023-33362

published 2023-05-23

CVE-2023-33362: Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.

Priority P2 70 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
piwigo	piwigo	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /admin.php?page=profile&user_id=' OR 1=1 --↗

path /admin.php↗

version Piwigo 13.6.0↗

• → Monitor HTTP GET requests to /admin.php with the 'page=profile' parameter where 'user_id' contains SQL metacharacters such as single quotes, OR clauses, or comment sequences (-- or #). ↗
• → The injection point is the 'user_id' parameter within the 'profile' page of the Piwigo admin interface; alert on any non-integer or SQL-syntax-bearing value supplied to this parameter. ↗
• → Exploitation requires an authenticated admin session; correlate suspicious SQL injection attempts in /admin.php?page=profile with prior successful admin logins to identify post-auth abuse. ↗

• · Exploitation requires prior authentication as an admin user; this is a post-authentication SQL injection, so network-level blocking alone is insufficient — admin account hygiene and MFA are critical mitigating controls. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89