CVE-2017-17824

The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batch_manager_unit.php element_ids parameter in unit mode. An attacker can exploit this to gain access to the data in a connected MySQL database.

• CWE-89

• https://github.com/Piwigo/Piwigo/commit/f7c8e0a947a857ff5d31dafd03842df41959b84cPatch, Third Party Advisory
• https://github.com/Piwigo/Piwigo/issues/825Third Party Advisory
• https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo%202.9.2.mdExploit, Third Party Advisory
• https://github.com/Piwigo/Piwigo/commit/f7c8e0a947a857ff5d31dafd03842df41959b84cPatch, Third Party Advisory
• https://github.com/Piwigo/Piwigo/issues/825Third Party Advisory
• https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo%202.9.2.mdExploit, Third Party Advisory

Published

Dec 21, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17818In Netwide Assembler (NASM) 2.14rc0, there is a heap-based b…
• CVE-2017-17819In Netwide Assembler (NASM) 2.14rc0, there is an illegal add…
• CVE-2017-17820In Netwide Assembler (NASM) 2.14rc0, there is a use-after-fr…
• CVE-2017-17821WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari …
• CVE-2017-17822The List Users API of Piwigo 2.9.2 is vulnerable to SQL Inje…
• CVE-2017-17823The Configuration component of Piwigo 2.9.2 is vulnerable to…
• CVE-2017-17825The Batch Manager component of Piwigo 2.9.2 is vulnerable to…
• CVE-2017-17826The Configuration component of Piwigo 2.9.2 is vulnerable to…
• CVE-2017-17827Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via…
• CVE-2017-17828Bus Booking Script has XSS via the results.php datepicker pa…4.8
• CVE-2017-17829Bus Booking Script has SQL Injection via the admin/view_seat…
• CVE-2017-1783IBM Cognos Analytics 11.0 could allow a local user to change…