一、 漏洞 CVE-2024-43018 基础信息
漏洞信息
                                        # N/A

## 概述

Piwigo 13.8.0 及更低版本存在 SQL 注入漏洞，影响 `max_level` 和 `min_register` 参数。

## 影响版本

- Piwigo 版本 13.8.0 及以下版本

## 细节

- 漏洞存在于文件 `include/ws_functions/pwg.users.php` 中的 `ws_user_getList` 函数。
- 该函数处理 `max_level` 和 `min_register` 参数时未正确过滤或转义输入内容，导致潜在 SQL 注入攻击。
- `ws_user_getList` 被 `ws.php` 文件调用，可用于高级搜索用户功能。
- 漏洞可通过 `/admin.php?page=user_list` 接口进行访问并利用。

## 影响

攻击者可能通过构造恶意参数注入 SQL 语句，进而读取或篡改数据库内容，造成敏感数据泄露、权限提升或其他恶意操作。
提示
尽管我们采用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。
神龙会尽力确保数据准确，但也请结合实际情况进行甄别与判断。
神龙祝您一切顺利！
漏洞标题
N/A
来源：美国国家漏洞数据库 NVD
漏洞描述信息
Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.php and this same function is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=user_list.
来源：美国国家漏洞数据库 NVD
CVSS信息
N/A
来源：美国国家漏洞数据库 NVD
漏洞类别
N/A
来源：美国国家漏洞数据库 NVD
二、漏洞 CVE-2024-43018 的公开POC
# POC 描述 源链接 神龙链接
1 None https://github.com/joaosilva21/CVE-2024-43018 POC详情
三、漏洞 CVE-2024-43018 的情报信息

  • 标题： SQL Injection in User List visualization via Admin > Manage · Issue #2197 · Piwigo/Piwigo -- 🔗来源链接

    标签：

    SQL Injection in User List visualization via Admin > Manage · Issue #2197 · Piwigo/Piwigo

  • 标题： GitHub - joaosilva21/CVE-2024-43018: Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.php and this same function that is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=user_list. -- 🔗来源链接

    标签：

    GitHub - joaosilva21/CVE-2024-43018: Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.php and this same function that is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=user_list.

  • 标题： GitHub - inesmarcal/CVE-2024-43018: Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.php and this same function that is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=user_list. -- 🔗来源链接

    标签：

    GitHub - inesmarcal/CVE-2024-43018: Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.php and this same function that is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=user_list.
  • https://nvd.nist.gov/vuln/detail/CVE-2024-43018
四、漏洞 CVE-2024-43018 的评论

暂无评论

发表评论