Sense of Security is one of Australia’s most trusted providers of cyber resilience, information security and risk management services.

Latest announcements
© Copyright Sense of Security

Security Advisory – SOS-09-007 – Piwigo SQL Injection Vulnerability

Release Date: 17-Aug-2009

Last Update:

Vendor Notification Date: 15-Jun-2009

Product: Piwigo

Platform: Independent

Affected versions: 2.0.0 (verified), possibly others

Severity Rating: Medium

Impact: Manipulation of data

Attack Vector: Remote with authentication

Solution Status: Upgrade to 2.0.3

CVE reference: Not yet assigned


Piwigo is a photo gallery application written in PHP. The application suffers from a SQL injection vulnerability in comments.php, as it fails to validate data supplied in the “items_number” variable before being used in an SQL query.

SQL injection attacks can give an attacker access to backend database contents, the ability to remotely execute system commands, or in some circumstances the means to take control of the operating system hosting the database.

Please refer to the PDF version of this advisory for proof of concept code examples.


Upgrade to version 2.0.3.

Discovered By

Sense of Security Labs.

Our expert consultants are here to help you. For all your Cyber Security needs please contact us today.

No Comments

Sorry, the comment form is closed at this time.