CVE-2026-44642

Executive Summary

CVE-2026-44642 is an unauthenticated SQL injection in Piwigo, an open source web photo gallery application, affecting versions prior to 16.4.0. The flaw resides in check_upgrade_access_rights() within admin/include/functions_upgrade.php, where conditional escaping of the submitted username fails on PHP 8 and later because the removed get_magic_quotes_gpc function no longer exists, allowing unauthenticated attacker-controlled input to be concatenated directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials, resulting in unauthorized database integrity changes and service disruption.

Technical Analysis

The vulnerability is a classic CWE-89 SQL injection arising from defective input sanitization logic gated on a runtime environment check. The affected function, check_upgrade_access_rights(), is located in admin/include/functions_upgrade.php. According to the NVD description, the function "conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists." Because get_magic_quotes_gpc() was deprecated in PHP 7.4 and removed in PHP 8.0, any deployment running PHP 8 or later will evaluate that condition as false, and the username input will bypass the intended escaping routine entirely.

As a result, on PHP 8+ installations, "an unauthenticated username" is "concatenate[d] directly into the upgrade authentication SQL query." This is a string-concatenation injection point rather than a parameterized query, meaning the attacker controls a portion of the SQL statement's text. The NVD description states further that "when database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials."

The attack surface is the pre-upgrade authentication check exposed by the Piwigo web front end when the application detects that pending database upgrades exist. Because the check is an authentication gate, the injection point is reachable without prior authentication (PR:N). The mechanism relies on logical manipulation of the query's result set: the attacker shapes the injected SQL so that the authentication query returns data satisfying both a "status" condition and a "password" check. No public proof-of-concept, Nuclei template, or exploit code was provided in the source data, so the exact payload syntax cannot be stated with certainty and is not fabricated here.

The preconditions are notable (AC:H): (1) the target must be running PHP 8 or later, and (2) database upgrades must be pending. Both conditions are realistic in production — PHP 8 is the mainstream runtime, and galleries are frequently left with upgrades pending after a manual or interrupted update. The vulnerability class is authenticated-gate bypass via SQL injection, and the terminal state (PHPWG_IN_UPGRADE being set) enables "upgrade execution," which the description characterizes as causing "unauthorized database integrity changes and service disruption."

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: The attacker identifies internet-exposed Piwigo installations, for example via the Shodan dorks http.title:"Piwigo" or http.html:"Piwigo". The attacker must establish whether the instance is running PHP 8+ (e.g., by inducing error pages, analyzing X-Powered-By or server banners, or fingerprinting behavior) and whether database upgrades are pending.

2. Triggering the flaw class: When upgrades are pending, the Piwigo front end exposes the upgrade authentication path. Because check_upgrade_access_rights() only escapes the username when get_magic_quotes_gpc exists, and that function is absent on PHP 8+, the submitted username is concatenated unescaped into the authentication SQL query. The attacker submits a crafted username designed to manipulate the query result.

3. Payload / execution method (vulnerability-class level): SQL injection permits the attacker to alter the query's logic so that the returned row satisfies the status and password checks. The NVD description explicitly states that "a crafted query result can satisfy the status and password checks." Success sets PHPWG_IN_UPGRADE, granting the attacker the ability to "authorize upgrade execution without valid administrator credentials." This is a logic-bypass injection: the attacker is not directly shown to execute arbitrary commands, but the resulting authorization state enables the upgrade routine to run.

4. Post-exploitation impact: With upgrade execution authorized, the attacker can trigger "unauthorized database integrity changes and service disruption." Integrity changes may include destructive or unexpected schema/data modifications performed by the upgrade process, and disruption may manifest as gallery downtime, data loss, or corruption. The CVSS vector C:H/I:H/A:H confirms high confidentiality, integrity, and availability impact. Because the impact is scoped to the vulnerable component (S:U) and requires the pending-upgrade precondition (AC:H), the achievable blast radius is bounded but severe for the affected instance.

Impact Assessment

The CVSS 3.1 base score is 8.1 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Network reachability (AV:N) and no required privileges (PR:N) make this exploitable by unauthenticated remote actors, while the high attack complexity (AC:H) reflects the environmental preconditions: PHP 8+ and pending database upgrades. No user interaction is required (UI:N). Confidentiality, integrity, and availability impacts are all High, consistent with the NVD description's stated outcomes of "unauthorized database integrity changes and service disruption." The scope is Unchanged (S:U), meaning impact remains within the security authority of the vulnerable Piwigo component. CISA KEV status is NO, and no EPSS score has been assigned by FIRST.org, so there is currently no evidence of confirmed exploitation in the wild from the provided data. Business impact for gallery operators includes potential destruction or alteration of photo metadata, user records, and configuration data, plus downtime during an unauthorized or corrupted upgrade. Blast radius is limited to individual affected instances; there is no data indicating cross-instance or supply-chain propagation.

Detection Guidance

Sigma Rule

title: Piwigo Unauthenticated SQL Injection in Upgrade Authentication Check
id: 7c9d1f42-6a2b-4d1e-9f30-8b2c4e6a1d77
status: experimental
description: Detects SQL injection attempts against Piwigo admin/include/functions_upgrade.php when database upgrades are pending (CVE-2026-44642).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-44642
author: valtersit.com
date: 2026/06/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/admin/include/functions_upgrade.php'
      - '/install/'
  selection_payload:
    cs-uri-query|contains:
      - "' or "
      - "' OR "
      - "or 1=1"
      - "union select"
      - "UNION SELECT"
      - "--"
      - "/*"
  condition: selection_path and selection_payload
falsepositives:
  - Legitimate administrative traffic containing quoted strings
level: high

YARA Rule

rule CVE_2026_44642_Piwigo_Upgrade_SQLi
{
    meta:
        description = "Detects references to the vulnerable Piwigo upgrade authentication function and unsafe query construction (CVE-2026-44642)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-44642"
        author = "valtersit.com"
        date = "2026-06-01"
        severity = "high"
    strings:
        $fn = "check_upgrade_access_rights" ascii
        $file = "functions_upgrade.php" ascii
        $gpc = "get_magic_quotes_gpc" ascii
        $flag = "PHPWG_IN_UPGRADE" ascii
    condition:
        ($file and ($fn or $gpc)) or ($flag and $gpc)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-44642 Piwigo Upgrade Authentication SQL Injection Attempt"; flow:established,to_server; http.uri; content:"/admin/include/functions_upgrade.php"; nocase; http.uri; pcre:"/(%27|')\s*(or|OR|and|AND)\s+[0-9]|union(%20|\s)+select/i"; classtype:web-application-attack; reference:cve,2026-44642; sid:2026446421; rev:1;)

Elastic Detection

network where
  http.request.method == "GET" or http.request.method == "POST" and
  (
    stringContains(http.request.uri, "/admin/include/functions_upgrade.php") or
    stringContains(http.request.uri, "/install/")
  ) and
  (
    stringContains(http.request.uri, "%27%20or") or
    stringContains(http.request.uri, "' or ") or
    stringContains(http.request.uri, "union%20select") or
    stringContains(http.request.uri, "union select")
  )

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=lower(uri)
| where match(uri, "/admin/include/functions_upgrade\\.php|/install/")
| where match(uri, "(\\%27|') *(or|and) |union(\\+|%20| )select|or 1=1|--")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, dest, status
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,piwigo,cve-2026-44642,">
  <rule id="100642" level="12">
    <if_sid>31100</if_sid>
    <id>^404$|^200$|^500$</id>
    <match>/admin/include/functions_upgrade.php|/install/</match>
    <regex>(\%27|') *(or|and) |union(\+|%20| )select|or 1=1|--</regex>
    <description>CVE-2026-44642: Possible Piwigo upgrade authentication SQL injection attempt detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, affected-version list, or OSV package mapping was provided in the source data. The NVD description states the vulnerability is fixed in Piwigo 16.4.0; this is the remediation target, but no tracked patch source corroborates it, so it is treated as unverified here.

1. Immediate mitigations:
   • Restrict access to the Piwigo administrative and upgrade paths (/admin/, /install/) at the network or reverse-proxy layer so they are not reachable by unauthenticated internet clients.
   • Complete any pending database upgrades as soon as possible, since the vulnerability requires pending upgrades to be exploitable; removing that precondition closes the reachable attack state.
   • Where possible, apply virtual patching (WAF rules) targeting SQL metacharacters and SQL keywords in parameters submitted to admin/include/functions_upgrade.php.
   • Monitor web logs for injection patterns against the affected path using the detection rules above.
2. Patch/upgrade steps:
   • Upgrade Piwigo to version 16.4.0 or later as stated in the NVD description; until a tracked patch source confirms this, verify against the vendor's official release channel before deployment.
   • Back up the database and files prior to upgrading, and validate post-upgrade integrity.
3. Long-term hardening:
   • Run Piwigo on a supported, current PHP release and keep PHP, the database, and the gallery application patched.
   • Enforce parameterized queries in custom or legacy code paths; never rely on get_magic_quotes_gpc-style conditional escaping, which is unreliable across PHP versions.
   • Apply least-privilege to the database account used by Piwigo and require authenticated access for all administrative and upgrade functions.

References

• NVD — CVE-2026-44642: https://nvd.nist.gov/vuln/detail/CVE-2026-44642
• Piwigo official project site / release information: https://piwigo.org
• CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-44642 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog No public PoC, Nuclei template, exploit code, or threat actor campaign is associated with CVE-2026-44642 in the provided data; no exploit-in-the-wild evidence was available.