A critical SQL injection vulnerability in Piwigo allows unauthenticated attackers to perform unauthorized database operations and data extraction.

This is an SQL injection vulnerability (CWE-89) triggered by the improper neutralization of user-supplied input in the ratings parameter within the filtered search flow. An unauthenticated guest can pass a crafted value to the pwg.images.filteredSearch.create function, leading to potential database information disclosure.

The ability for an unauthenticated user to interact directly with the application database presents a severe risk to data confidentiality and integrity. With a CVSS score of 9.1, this vulnerability allows attackers to bypass standard access controls to perform unauthorized queries, potentially leading to the full compromise of sensitive gallery data or user information.

Immediate Action: Since no official patch is currently available, administrators should disable the rating feature or restrict access to the affected search functionality until a security update is released by the vendor.

Proactive Monitoring: Monitor server logs for unusually long response times or high volumes of error messages originating from the pwg.images.php endpoint, which may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting numeric array parameters in search requests.

Public Exploit Available: Unknown

Given the critical nature of this SQL injection flaw and the current lack of a vendor-provided patch, immediate defensive action is required. Organizations running Piwigo should prioritize disabling the affected rating feature and implementing strict WAF filtering to prevent potential exploitation until the vendor releases a formal fix.