picu – Online Photo Proofing Gallery Security & Risk Analysis

The picu plugin version 3.4.0 exhibits a mixed security posture. While it demonstrates good practices in several areas, such as the absence of dangerous functions and a relatively low number of critical taint flows, significant concerns remain. The presence of two AJAX handlers without authentication checks presents a direct attack vector, potentially allowing unauthorized users to trigger plugin functionality. Furthermore, the fact that 100% of its single SQL query is not using prepared statements is a major red flag for SQL injection vulnerabilities, especially given the potential for unsanitized data to reach this query.

The vulnerability history, though currently clear of unpatched issues, shows a past medium-severity vulnerability attributed to missing authorization. This pattern, combined with the current lack of authorization checks on AJAX handlers, suggests a recurring issue with properly securing entry points. While the plugin has a substantial number of outputs and file operations, a majority of outputs are properly escaped, which is a positive sign. However, the identified risks related to unprotected entry points and raw SQL queries are substantial and require immediate attention.