CVE-2017-16893

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.9.3

Description The issue allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The "tags.php" endpoint is affected, specifically the edit list parameter, which is not sanitized and is used to construct an SQL query to retrieve a list of registered users into the application.

Recommendations For Piwigo version 2.9.2 and possibly prior, update to a version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the "tags.php" endpoint or sanitizing the edit list parameter to minimize the risk of exploitation.