Cyber Resilience

CVE-2023-33362

CriticalPublic PoC

Published: 23 May 2023

Published
23 May 2023
Modified
16 April 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0483 89.8th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-33362 is a critical-severity SQL Injection (CWE-89) vulnerability in Piwigo Piwigo. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 10.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Piwigo 13.6.0 is affected by a SQL injection vulnerability in the profile function, tracked as CVE-2023-33362 and assigned CWE-89. The issue carries a CVSS 3.1 score of 9.8, reflecting network attackability without authentication or user interaction and full impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply crafted input to the profile function to execute arbitrary SQL commands, enabling extraction or modification of database contents and potential takeover of the Piwigo instance. Public proof-of-concept material and issue reports have been posted to GitHub, but the supplied references contain no explicit mitigation guidance or patch details. The associated EPSS score reached a modest peak of 0.0609 before receding to its current value of 0.0483, indicating limited sustained exploitation interest.

EU & UK References

Vulnerability details

Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

piwigo
piwigo
13.6.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References