Piwigo, a web photo gallery, contains a second‑order SQL injection that allows an authenticated administrator to inject a malicious ORDER BY clause into the database query. The flaw arises when administrator‑controlled image_order values are stored without checking against the sort‑field whitelist; later, these expressions are concatenated into SQL ORDER BY clauses in several admin scripts. An attacker can craft an expression that discloses, modifies, or disrupts database data. The vulnerability leads to loss of confidentiality, integrity, or availability of data stored in the gallery.

The issue affects Piwigo versions prior to 16.4.0. Administrators who have access to the admin interface of any Piwigo installation before that release are impacted.

The vulnerability receives a CVSS score of 7.2 and is not listed in CISA's KEV catalog. The EPSS score is not available, so the likelihood of exploitation in the wild cannot be quantified from the data. Attackers must be authenticated administrators; the exploitation path requires the attacker to store a crafted image_order expression via the element_set_ranks script and later trigger it in one of the batch manager or category functions. Once triggered, the attacker can read, alter, or delete database content. The attack surface is limited to privileged administrative accounts, but the impact on data can be significant.