CVE-2017-17823

CVE-2017-17823 describes a SQL Injection vulnerability in the Configuration component of Piwigo version 2.9.2, specifically through the 'order_by' array parameter in admin/configuration.php. This flaw allows an authenticated attacker with high privileges to extract sensitive data from the connected MySQL database. The vulnerability has a CVSS score of 4.9 (Medium), indicating a network-based attack with low complexity, but requires high privileges to exploit, leading to high confidentiality impact. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, suggesting it is not widely recognized or exploited.