CVE-2026-42324: Piwigo Second-Order SQL Injection via image_order[]

Executive Summary

A second-order SQL injection vulnerability, tracked as CVE-2026-42324, has been disclosed in Piwigo, the open-source photo gallery application for the web. The flaw carries a CVSS score of 7.2 (High) and stems from admin/element_set_ranks.php, which stores administrator-controlled image_order[] values without enforcing Piwigo's existing sort-field whitelist. The unvalidated value is written directly into the image_order column of the categories table, and is later concatenated — unsanitized — into ORDER BY SQL clauses by several downstream files, including admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.inc.php, and include/ws_functions/pwg.categories.php.

Exploitation requires authenticated administrator access — this is not an unauthenticated, internet-facing attack path. However, because the malicious payload is stored and triggered on a later, separate request (the hallmark of a second-order injection), it can evade request-level input filtering and WAF rules that only inspect the initial write. Once triggered, an attacker with admin credentials can use UNION-based injection techniques to disclose sensitive database contents — including stored user credentials — or modify and delete data. The vulnerability affects all Piwigo releases ≤ 16.4.0 and is fixed in Piwigo 16.4.0.

Vulnerability Overview

Affected Versions

Attack Vector

1. Attacker authenticates to Piwigo as an administrator (or hijacks/social-engineers
   an existing admin session)
2. Attacker submits a POST request to admin/element_set_ranks.php with the
   album sort mode set to "user_define" and a crafted image_order[] array value
3. element_set_ranks.php concatenates the submitted image_order[] entries
   WITHOUT validating them against Piwigo's existing sort-field whitelist
4. The crafted expression is written verbatim into the image_order column
   of the categories table via an UPDATE statement
5. On a LATER, separate request, the stored image_order value is read back
   and concatenated directly into an ORDER BY clause by one of:
     - admin/batch_manager_global.php
     - admin/batch_manager_unit.php
     - include/section_init.inc.php
     - include/ws_functions/pwg.categories.php
6. The injected SQL executes in the context of that query (second-order
   injection — payload storage and payload execution are decoupled)
7. Attacker leverages UNION-based injection to extract arbitrary table data,
   including the user table (credentials, password hashes, session tokens)
8. Depending on database permissions, attacker may also modify or delete
   records via the same injection point

Impact of Successful Exploitation

Immediate Remediation

Step 1: Upgrade to Piwigo 16.4.0

# Back up the database and files before upgrading
mysqldump -u <user> -p <piwigo_db> > piwigo_backup_$(date +%F).sql
 
# Download and apply the 16.4.0 release (or use the built-in
# Piwigo auto-update feature from the admin dashboard)
# https://github.com/Piwigo/Piwigo/releases/tag/16.4.0

Verify the running version afterward via Administration > General > Configuration or by checking include/constants.php for PHPWG_VERSION.

Step 2: Audit Existing Album Sort Values

After upgrading, review the image_order column in the categories table for any values that don't match Piwigo's legitimate sort-field syntax — these may indicate a payload was already stored prior to patching.

SELECT id, name, image_order FROM piwigo_categories
WHERE image_order IS NOT NULL;

Reset any suspicious image_order values to NULL or a known-good default (e.g. rank ASC) and restart affected sessions.

Step 3: Harden Admin Access

Because exploitation requires an authenticated administrator account, reducing exposure of admin credentials materially reduces risk:

1. Enforce strong, unique passwords and enable two-factor authentication for all administrator accounts
2. Audit the admin user list and remove any stale or unnecessary administrator accounts
3. Restrict access to admin/ paths at the web server or reverse proxy level to trusted IP ranges where feasible
4. Review recent admin activity and Batch Manager usage logs for unfamiliar sort-order configurations

If Immediate Patching Is Not Possible

1. Restrict administrator panel access to a VPN or trusted network segment
2. Monitor and alert on POST requests to admin/element_set_ranks.php
3. Review database query logs for anomalous ORDER BY clauses referencing UNION, subqueries, or unexpected column names
4. Apply a WAF rule flagging non-standard characters (UNION, SELECT, comment sequences) in image_order[] POST parameters as a stopgap — note this only mitigates the initial write, not the second-order trigger

Detection Indicators

References

• NIST NVD — CVE-2026-42324
• GitHub Security Advisory — GHSA-jhp4-7f82-8f6q: Second-Order SQL Injection in Piwigo
• Piwigo 16.4.0 Release