{"id":"CVE-2026-62262","published":"2026-09-25T16:17:26.750","lastModified":"2026-09-29T20:17:21.483","description":"Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. include/ws_functions/pwg.images.php stores the unvalidated value in the search rules, and include/functions_search.inc.php integer-casts only the lower rating bound while concatenating the raw value as the SQL upper bound. This allows error-based or blind extraction of database information and database-dependent time delays through the public search flow. No fixed version is available as of this review.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Piwigo/Piwigo/commit/9755d88edf38b94bafdedb0b3aba7304a94e2e5c","tags":[]},{"url":"https://github.com/Piwigo/Piwigo/commit/aede490a0b3a6c246f1f4689ca86c8fee377a7ae","tags":[]},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hq29-8hhx-5jwc","tags":[]},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hq29-8hhx-5jwc","tags":[]}],"exploitRefs":[{"url":"https://github.com/Piwigo/Piwigo/commit/9755d88edf38b94bafdedb0b3aba7304a94e2e5c","tags":[]},{"url":"https://github.com/Piwigo/Piwigo/commit/aede490a0b3a6c246f1f4689ca86c8fee377a7ae","tags":[]},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hq29-8hhx-5jwc","tags":[]},{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hq29-8hhx-5jwc","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows unauthenticated users to extract database information through SQL injection by manipulating the ratings parameter in the search functionality.","exploitability":"Exploitation is relatively easy as it requires only crafting a specific ratings value and opening the returned URL. Precondition is that rating functionality is enabled.","blast_radius":"If exploited, this could lead to full database compromise, including sensitive data exposure.","remediation":"Disable the rating functionality or apply a patch if available. No fixed version is mentioned, so disable the feature if unable to patch.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","rce","unauth","piwigo"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-28T08:53:21.685Z"}}