CVE-2015-2035

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/130432/CMS-Piwigo-2.7.3-Cross-Site-Scripting-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://piwigo.org/forum/viewtopic.php?id=25179Vendor Advisory
http://piwigo.org/releases/2.7.4Patch, Release Notes, Vendor Advisory
http://seclists.org/fulldisclosure/2015/Feb/73Exploit, Mailing List, Third Party Advisory
http://sroesemann.blogspot.de/2015/01/sroeadv-2015-06.htmlNot Applicable
http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-06.htmlNot Applicable
http://www.securityfocus.com/bid/72689
http://packetstormsecurity.com/files/130432/CMS-Piwigo-2.7.3-Cross-Site-Scripting-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://piwigo.org/forum/viewtopic.php?id=25179Vendor Advisory
http://piwigo.org/releases/2.7.4Patch, Release Notes, Vendor Advisory
http://seclists.org/fulldisclosure/2015/Feb/73Exploit, Mailing List, Third Party Advisory
http://sroesemann.blogspot.de/2015/01/sroeadv-2015-06.htmlNot Applicable
http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-06.htmlNot Applicable
http://www.securityfocus.com/bid/72689

Timeline

Published: Feb 20, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-20396.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote atta CVE-2015-20404.3Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPr CVE-2015-20414.6net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain p CVE-2015-20424.6net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potential CVE-2015-20434.3Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web sc CVE-2015-20442.1The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest CVE-2015-20452.1The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properly initialize data structures, which allows local guest users CVE-2015-20466.1Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20.CVE-2015-20472.6The rsaauth extension in TYPO3 4.3.0 through 4.3.14, 4.4.0 through 4.4.15, 4.5.0 through 4.5.39, and 4.6.0 through 4.6.18, when configured f CVE-2015-20486.8Cross-site request forgery (CSRF) vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote attackers to hijack the auth CVE-2015-20499.0Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitr CVE-2015-205010.0D-Link DAP-1320 Rev Ax with firmware before 1.21b05 allows attackers to execute arbitrary commands via unspecified vectors.