adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

XSS Critical vulnerability {admin} account #1241

New Issue
Closed
opened 2026-10-05 00:37:21 +02:00 by adam · 8 comments
adam commented 2026-10-05 00:37:21 +02:00
Owner
Copy link
Copy source

Hello dear friends, you should fix this serious problem!
KR

Hello dear friends, you should fix this serious problem! KR <!-- github-sync-id:910181248 -->
adam closed this issue 2026-10-05 00:37:21 +02:00
adam commented 2026-10-05 00:37:22 +02:00
Author
Owner
Copy link
Copy source

Hi,

I don't understand. You mean that if you have access to the database and the code, you can insert some Javascript? Yes, I confirm. Not a security issue, as far as I understand.

Hi, I don't understand. You mean that if you have access to the database and the code, you can insert some Javascript? Yes, I confirm. Not a security issue, as far as I understand. <!-- github-comment-id:853673741 -->
adam commented 2026-10-05 00:37:23 +02:00
Author
Owner
Copy link
Copy source

Just because you're an administrator doesn't mean you're a superman!

Just because you're an administrator doesn't mean you're a superman! <!-- github-comment-id:853711552 -->
adam commented 2026-10-05 00:37:24 +02:00
Author
Owner
Copy link
Copy source

This is a BIG Problem dear friend! Do, you understand what the f**k is this? I do this without any money for you and you do not understand, oh dear. Whatever =)
KR :D

This is a BIG Problem dear friend! Do, you understand what the f**k is this? I do this without any money for you and you do not understand, oh dear. Whatever =) KR :D <!-- github-comment-id:853712433 -->
adam commented 2026-10-05 00:37:24 +02:00
Author
Owner
Copy link
Copy source

So, please look carefully: https://streamable.com/p3ov5u
KR and have a nice day. :-)

So, please look carefully: https://streamable.com/p3ov5u KR and have a nice day. :-) <!-- github-comment-id:853715174 -->
adam commented 2026-10-05 00:37:25 +02:00
Author
Owner
Copy link
Copy source

You are not answering:
If you have access to the backend and the database, you can already change every html code you want.
Can you explain why storing js script and interpretating it is more dangerous than changing every HTML template, creating a plugin who can change every urls and so on?

You are not answering: If you have access to the backend and the database, you can already change every html code you want. Can you explain why storing js script and interpretating it is more dangerous than changing every HTML template, creating a plugin who can change every urls and so on? <!-- github-comment-id:853717424 -->
adam commented 2026-10-05 00:37:26 +02:00
Author
Owner
Copy link
Copy source

You are not answering:
If you have access to the backend and the database, you can already change every html code you want.
Can you explain why storing js script and interpretating it is more dangerous than changing every HTML template, creating a plugin who can change every urls and so on?

Because dear, some malicious guys can execute malicious code by using exactly JavaScript, that's why!
KR and exit 0;

> You are not answering: > If you have access to the backend and the database, you can already change every html code you want. > Can you explain why storing js script and interpretating it is more dangerous than changing every HTML template, creating a plugin who can change every urls and so on? Because dear, some malicious guys can execute malicious code by using exactly JavaScript, that's why! KR and exit 0; <!-- github-comment-id:853719611 -->
adam commented 2026-10-05 00:37:27 +02:00
Author
Owner
Copy link
Copy source

Soooo executing JS in titles is more dangerous than creating a plugin in PHP, or changing a template to execute some JS or PHP ... ?

Soooo executing JS in titles is more dangerous than creating a plugin in PHP, or changing a template to execute some JS or PHP ... ? <!-- github-comment-id:853722630 -->
adam commented 2026-10-05 00:37:27 +02:00
Author
Owner
Copy link
Copy source

Dear friends, I'm finished with this case. =)
For the next steps, you should care of it alone. This is your software, I just trying to help you.
KR and exit 0;

Dear friends, I'm finished with this case. =) For the next steps, you should care of it alone. This is your software, I just trying to help you. KR and exit 0; <!-- github-comment-id:853746847 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1241