diff --git a/advisories/unreviewed/2023/04/GHSA-4xvf-3477-vq63/GHSA-4xvf-3477-vq63.json b/advisories/unreviewed/2023/04/GHSA-4xvf-3477-vq63/GHSA-4xvf-3477-vq63.json index 4502ffe25fe20..c5b407f3d19c5 100644 --- a/advisories/unreviewed/2023/04/GHSA-4xvf-3477-vq63/GHSA-4xvf-3477-vq63.json +++ b/advisories/unreviewed/2023/04/GHSA-4xvf-3477-vq63/GHSA-4xvf-3477-vq63.json @@ -6,6 +6,7 @@ "aliases": [ "CVE-2023-26876" ], + "summary": "Piwigo version 13.5.0 suffers from a remote SQL injection vulnerability", "details": "SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.", "severity": [ { @@ -13,7 +14,30 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "piwigo" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "> 13.5.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 13.5.0" + } + } + ], "references": [ { "type": "ADVISORY", @@ -31,6 +55,10 @@ "type": "WEB", "url": "https://www.tempest.com.br" }, + { + "type": "PACKAGE", + "url": "filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id=" + }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/172059/Piwigo-13.5.0-SQL-Injection.html"