CVE-2026-42324

Executive Summary

CVE-2026-42324 is a stored SQL injection vulnerability in Piwigo, an open-source web photo gallery application. Prior to version 16.4.0, admin/element_set_ranks.php stores administrator-supplied image_order[] values without validating them against an existing sort-field whitelist, and those stored expressions are later concatenated into ORDER BY clauses across several administrative and API code paths. An authenticated administrator can store a crafted image_order expression and trigger it during a subsequent album or Batch Manager query, potentially disclosing, modifying, or disrupting database data across the entire Piwigo instance.

Technical Analysis

The vulnerability is a second-order (stored) SQL injection, classified under CWE-89. The root cause is a missing input-validation control: the application maintains an existing sort-field whitelist that is intended to constrain which column/expression values may be used for image ordering, but the code path in admin/element_set_ranks.php fails to enforce that whitelist when persisting administrator-controlled image_order[] values.

The specific mechanism described in the NVD entry is as follows:

1. Injection point (storage): admin/element_set_ranks.php accepts image_order[] values and stores them without enforcing the existing sort-field whitelist. This is where the crafted expression enters persistent state (the stored album image_order value).

2. Trigger points (execution): The stored album image_order expression is later concatenated into ORDER BY clauses by the following code paths, as named in the advisory:

   • admin/batch_manager_global.php
   • admin/batch_manager_unit.php
   • include/section_init.inc.php
   • include/ws_functions/pwg.categories.php

Because the stored value is directly concatenated into an ORDER BY clause rather than being parameterized or constrained to the whitelist, a crafted expression survives from the write path into the read/query path. The vulnerability is second-order because the payload is persisted first and executed only when one of the trigger paths builds a query using the stored value.

Preconditions stated in the advisory: exploitation requires (a) an authenticated administrator, and (b) at least one album that contains at least one photo. The precondition reflects the query shape: the affected ORDER BY logic is exercised when ordering images in an album that actually contains photos.

Impact on confidentiality, integrity, and availability: the advisory states the crafted expression can be used to "disclose, modify, or disrupt database data." This maps to the CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (score 7.2), meaning high confidentiality, integrity, and availability impact within the unchanged scope of the vulnerable component, requiring high privileges (administrator) and no user interaction, over the network.

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE, and no EPSS score has been published by FIRST.org. The precise payload syntax is therefore not documented in the available data; only the vulnerability class (second-order SQL injection via an unvalidated stored ORDER BY expression) and the named affected files are established.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the affected files named in the NVD description. No specific payload strings or additional function names are asserted beyond what is documented.

1. Reconnaissance / target identification. An attacker identifies a Piwigo deployment running a version prior to 16.4.0. Because exploitation requires administrative access, this stage focuses on obtaining valid administrator credentials (e.g., credential reuse, phishing, or prior compromise) rather than unauthenticated access. Live instances are typically identifiable via Piwigo-specific page titles/content.

2. Triggering the flaw class. With administrator access, the attacker supplies crafted image_order[] values to admin/element_set_ranks.php. The application stores these values without applying the existing sort-field whitelist. This establishes the persistent malicious expression on the target album's image_order field. The advisory notes that at least one album must contain at least one photo for the later query paths to execute.

3. Payload / execution method (vulnerability-class level). The stored album image_order expression is subsequently concatenated into ORDER BY clauses when the affected code paths run — admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.inc.php, or include/ws_functions/pwg.categories.php. Triggering any of these (for example, an album view through the section-init path or a Batch Manager operation) causes the database to evaluate the injected expression as part of the ORDER BY clause. Because the value flows into a SQL statement without parameterization, the injection class permits arbitrary SQL manipulation within the query context.

4. Post-exploitation impact. Per the advisory, a successful exploit can disclose, modify, or disrupt database data. In a SQL-injection context this typically encompasses reading data outside the intended album scope (confidentiality), altering stored records (integrity), and degrading or interrupting database-backed functionality (availability). The CVSS subscores (C:H/I:H/A:H) reflect high impact on all three.

Impact Assessment

CVE-2026-42324 carries a CVSS 3.1 base score of 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

• Attack Vector (Network): The vulnerable administrative and web-service code paths are remotely reachable over the network.
• Attack Complexity (Low): No special conditions beyond the documented preconditions (admin session; at least one album with at least one photo) are required.
• Privileges Required (High): The attacker must hold administrator privileges. This materially constrains who can weaponize the issue, but is a common post-compromise escalation path and a risk where admin accounts are shared, weakly protected, or obtained through other means.
• User Interaction (None): No victim action is needed beyond the administrator's own privileged actions.
• Scope (Unchanged) and C/I/A (High/High/High): Successful exploitation is assessed to yield high impact on confidentiality, integrity, and availability of the Piwigo database data, as explicitly stated in the advisory ("disclose, modify, or disrupt database data").

Affected systems: All Piwigo deployments prior to 16.4.0. Piwigo is widely self-hosted for photo galleries, including by media, education, government, and enterprise teams, so the blast radius spans any internet-facing instance in scope of an admin-credential compromise.

Business impact: Because the database is the system of record for the entire gallery, a successful second-order SQL injection can expose user/account data and private album contents, permit tampering with stored metadata and album content, and cause denial of service against the gallery backend. The High privilege requirement means exploitation is most likely as a lateral-movement or post-compromise objective rather than an initial-access vector.

Exploit maturity: No public PoC, exploit code, or Nuclei template is available, and the CVE is not in CISA KEV. There is no evidence in the provided data of exploit-in-the-wild. The principal risk driver is therefore the unpatched status and the high-privilege, network-reachable nature of the flaw rather than known active exploitation.

Detection Guidance

Detection should focus on (a) tampering with stored rank/order values via administrative endpoints and (b) SQL-injection syntax appearing in image_order parameters or in resulting ORDER BY database activity. The rules below are pattern-based approximations; tune thresholds to your environment.

Sigma Rule

title: Potential SQL Injection via Piwigo image_order Parameter
id: 3f9a1c2e-7b64-4d2a-9c1e-piwigo42324
status: experimental
description: Detects attempts to inject SQL syntax via the Piwigo image_order parameter, the storage point for CVE-2026-42324 in element_set_ranks.php.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-42324
author: SOC Detection Engineering
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.89
logsource:
  category: webserver
detection:
  selection_url:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - 'element_set_ranks.php'
      - 'batch_manager_global.php'
      - 'batch_manager_unit.php'
  selection_payload:
    cs-uri-query|contains:
      - 'image_order'
  selection_sqli:
    cs-uri-query|contains:
      - 'union'
      - 'select'
      - 'sleep('
      - 'benchmark('
      - 'extractvalue('
      - 'updatexml('
      - 'case when'
      - '--'
      - '/*'
  condition: selection_url and selection_payload and selection_sqli
falsepositives:
  - Legitimate administrative use of unusual ordering tokens
level: high

YARA Rule

rule CVE_2026_42324_Piwigo_SQLi_Image_Order
{
    meta:
        description = "Detects SQL-injection indicators targeting Piwigo image_order handling (CVE-2026-42324)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-42324"
        author = "SOC Detection Engineering"
        date = "2026-01-01"
        severity = "high"
    strings:
        $p1 = "image_order" ascii nocase
        $p2 = "element_set_ranks" ascii nocase
        $s1 = "union select" ascii nocase
        $s2 = "order by" ascii nocase
        $s3 = "sleep(" ascii nocase
        $s4 = "benchmark(" ascii nocase
        $s5 = "extractvalue(" ascii nocase
        $s6 = "updatexml(" ascii nocase
        $s7 = "case when" ascii nocase
    condition:
        $p1 or $p2 and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-42324 Piwigo image_order SQL Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"element_set_ranks.php"; http.request_body; content:"image_order"; nocase; pcre:"/(image_order)[^&]*(union|select|sleep\s*\(|benchmark\s*\(|extractvalue\s*\(|updatexml\s*\(|case\s+when)/i"; reference:cve,2026-42324; classtype:web-application-attack; sid:202642324; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where http.request.method == "POST" and
      http.request.body contains "image_order" and
      (http.request.body contains "union" or
       http.request.body contains "select" or
       http.request.body contains "sleep(" or
       http.request.body contains "benchmark(" or
       http.request.body contains "extractvalue(" or
       http.request.body contains "updatexml(") ]
  [ network where url.path contains "element_set_ranks.php" or
      url.path contains "batch_manager_global.php" or
      url.path contains "batch_manager_unit.php" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval body=coalesce(urldecode(form_data), cs_uri_query, uri_query, "")
| where (uri_path LIKE "%element_set_ranks.php%" OR uri_path LIKE "%batch_manager_global.php%" OR uri_path LIKE "%batch_manager_unit.php%")
| where match(body, "(?i)image_order") AND match(body, "(?i)(union\\s+select|sleep\\s*\\(|benchmark\\s*\\(|extractvalue\\s*\\(|updatexml\\s*\\(|case\\s+when|--|/\\*)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(body) as payloads by src_ip, user
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,piwigo,sqli,">
  <rule id="2026423" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>element_set_ranks.php|batch_manager_global.php|batch_manager_unit.php</url>
    <match>image_order</match>
    <regex type="pcre2">(?i)(union\s+select|sleep\s*\(|benchmark\s*\(|extractvalue\s*\(|updatexml\s*\(|case\s+when|--|/\*)</regex>
    <description>CVE-2026-42324 - Possible SQL injection via Piwigo image_order parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sqli_attempt,pci_dss_6.5.1,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source has been recorded by this report).

1. Immediate mitigations (until upgrade is validated):

   • Upgrade to Piwigo 16.4.0 or later, which the advisory states contains the fix. This is the only vendor-documented remediation in the provided data.
   • Restrict administrator access: enforce strong, unique credentials and MFA on all Piwigo admin accounts, and avoid shared admin logins. Exploitation requires admin privileges, so admin-account hardening is the highest-leverage compensating control.
   • Limit network exposure of administrative paths (admin/) to trusted networks or VPN; restrict or disable public reachability of Batch Manager and album-management interfaces where operationally feasible.
   • Apply WAF/IDS rules (see Detection Guidance) to flag image_order payloads containing SQL syntax, and alert on anomalous administrative activity from unusual source IPs.
   • Maintain least privilege on the Piwigo database account to limit the confidentiality, integrity, and availability impact of any successful injection.

2. Patch / upgrade steps:

   • Follow the vendor upgrade process to move from any version prior to 16.4.0 to 16.4.0 or newer.
   • After upgrading, re-validate that stored album image_order values are constrained by the sort-field whitelist (as fixed in 16.4.0) and audit existing stored image_order values for anomalies that may have been persisted before the upgrade.
   • If an instance cannot be upgraded immediately, treat it as high risk and prioritize it for isolation and monitoring.

3. Long-term hardening:

   • Remediate SQL construction patterns that concatenate stored user-controlled values into clauses such as ORDER BY. Prefer parameterized queries or strict allow-listing (the whitelist that this CVE bypassed) for any expression used in query structure.
   • Enforce server-side validation of image_order[] against the whitelist at every write path, not only at read time.
   • Add regression tests covering second-order injection across admin and web-service endpoints such as admin/element_set_ranks.php and the functions that build ORDER BY clauses.
   • Monitor Piwigo security advisories and track CVE-2026-42324 status; note that this CVE is not listed in CISA KEV and no public exploit is known at the time of writing.

References

• NVD — CVE-2026-42324: https://nvd.nist.gov/vuln/detail/CVE-2026-42324
• Piwigo project / release notes for version 16.4.0 (vendor fix reference): https://piwigo.org/
• MITRE CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-42324 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild evidence is available for CVE-2026-42324 in the provided data, and no associated threat actor campaigns have been documented. No EPSS score has been published by FIRST.org.