CVE-2026-96673
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.
취약점 유형
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.
참고 자료
- https://github.com/photoview/photoview
- https://github.com/photoview/photoview/blob/v2.4.0/api/routes/downloads.go#L19-L29
- https://github.com/photoview/photoview/commit/deb1b216e047a30803dc0f48a9fc3d4c4abda594
- https://github.com/photoview/photoview/pull/1453
- https://hackmd.io/@leediay/sqli-in-download-photoview
- https://www.vulncheck.com/advisories/photoview-through-2.4.0-sql-injection-via-album-download-route
공격자보다 먼저 취약점을 찾으세요.
GitHub로 로그인하고 1분 안에 첫 감사를 실행하세요. 무료 플랜은 신용카드가 필요 없습니다.