Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:PHP:PIWIGO-XSS |
|---|---|
Severity |
Minor |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Piwigo Cross Site Scripting |
Release Date |
2019/05/21 |
Update Number |
3173 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: Piwigo Cross Site Scripting
This signature detects attempts to exploit a known vulnerability against Piwigo. A successful attack can lead to Cross Site Scripting and SQL injection.
Extended Description
SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php.
Affected Products
- Piwigo piwigo 2.7.3
References
- BugTraq: 72690
- CVE: CVE-2015-2035
- CVE: CVE-2015-2034
- URL: http://piwigo.org/forum/viewtopic.php?id=25179