Piwigo Unauthenticated Remote Code Execution Vulnerability via PHP Code Injection in Database Configuration

A critical remote code execution vulnerability has been identified in the Piwigo installer, specifically in versions through 16.3.0. The issue arises because the installer accepts POST parameters for database configuration and writes them directly into a PHP configuration file without adequate sanitization. In PHP 8 and later, the `addslashes()` function, which could have provided some level of protection, is rendered ineffective as it relies on `get_magic_quotes_gpc()`, a function that was removed in PHP 8.0. This flaw allows raw user input to be directly interpolated into PHP code. An unauthenticated attacker can exploit this by injecting arbitrary PHP code through several POST parameters, including prefix, dbpasswd, dbhost, dbname, and dbuser. The injected code is written to `local/config/database.inc.php`, where it is executed with web server privileges on every page load.

Impact

Exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary system commands as the web server user (nginx or www-data), access and modify any files that the web server can reach, retrieve database credentials from the injected configuration file, and potentially install persistent backdoors that remain after the installation process is completed. Additionally, there is a risk of pivoting to internal services or escaping from the Docker container where Piwigo is running.

Reproduction

To reproduce this vulnerability, send a POST request to `install.php` with the database configuration parameters. Include malicious PHP code in the `prefix` parameter, which will be executed on the server. After the injection, the injected code can be triggered by accessing the Piwigo installation with a command specified in the `cmd` parameter.