adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

[Version <= 12.1.0]XSS vulnerability in the frontend #1386

New Issue
Closed
opened 2026-10-05 00:41:54 +02:00 by adam · 1 comment
adam commented 2026-10-05 00:41:54 +02:00
Owner
Copy link
Copy source

I found that piwigo Front-End can trigger xss，it means when the system administrator can trigger xss after logging into the backend

Please see below for details of the analysis

at first，We found a global filter in include/common.inc.php

1

it just handle GET, POST, COOKIE，then we can think whether it can be broken through other parameters

Then I found out that piwigo records the user's login and logout process

Take the exit process as an example(The login is also the same)，in include/functions_user.inc.php

function logout_user()
{
  global $conf;

  trigger_notify('user_logout', @$_SESSION['pwg_uid']);
  pwg_activity('user', @$_SESSION['pwg_uid'], 'logout');

  $_SESSION = array();
  session_unset();
  session_destroy();
  setcookie(session_name(),'',0,
      ini_get('session.cookie_path'),
      ini_get('session.cookie_domain')
    );
  setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain'));
}

After that, let's see what the pwg_activity function does in include/functions.inc.php

in this function，There is no filter parameter $_SERVER['HTTP_USER_AGENT']

2

then execute serialize and pwg_db_real_escape_string functions respectively

3

look at function(pwg_db_real_escape_string),it just prevent sql injection

function pwg_db_real_escape_string($s)
{
  return mysql_real_escape_string($s);
}

then we register a useryyds\yyds

4

then we click logout

5

then we just post like this，It is best to send more packages

6

url:http://test.y4tacker.top/identification.php
User-Agent："><script>alert(`Hacked By Y4tacker`)</script><"
POST:
username=yyds&password=yyds&redirect=%2F&login=submit

Next, after the system administrator has logged in，and visit http://xxx/admin.php?page=user_activity
7

and look it

8

I found that piwigo Front-End can trigger xss，it means when the system administrator can trigger xss after logging into the backend Please see below for details of the analysis at first，We found a global filter in `include/common.inc.php` ![1](https://user-images.githubusercontent.com/56486273/146197712-471df1d4-2d90-4a14-aea1-9f25d12414bd.png) it just handle GET, POST, COOKIE，then we can think whether it can be broken through other parameters Then I found out that piwigo records the user's login and logout process Take the exit process as an example(The login is also the same)，in `include/functions_user.inc.php` ```php function logout_user() { global $conf; trigger_notify('user_logout', @$_SESSION['pwg_uid']); pwg_activity('user', @$_SESSION['pwg_uid'], 'logout'); $_SESSION = array(); session_unset(); session_destroy(); setcookie(session_name(),'',0, ini_get('session.cookie_path'), ini_get('session.cookie_domain') ); setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain')); } ``` After that, let's see what the `pwg_activity` function does in `include/functions.inc.php` in this function，There is no filter parameter `$_SERVER['HTTP_USER_AGENT']` ![2](https://user-images.githubusercontent.com/56486273/146197730-c50fbedc-3493-4578-88f8-d133ff3d0679.png) then execute serialize and pwg_db_real_escape_string functions respectively ![3](https://user-images.githubusercontent.com/56486273/146197780-bb7b5034-9e65-4838-9dec-86f1d888e10b.png) look at function(pwg_db_real_escape_string),it just prevent sql injection ```php function pwg_db_real_escape_string($s) { return mysql_real_escape_string($s); } ``` then we register a user`yyds\yyds` ![4](https://user-images.githubusercontent.com/56486273/146197857-7db7d57f-4fe7-4571-a2aa-f055acf0c318.png) then we click `logout` ![5](https://user-images.githubusercontent.com/56486273/146197874-1fb0bf17-1a84-41d4-ae11-0b1e1442f860.png) then we just post like this，It is best to send more packages ![6](https://user-images.githubusercontent.com/56486273/146197891-df638a27-76c9-472f-97e3-bee9661abdd0.png) ```cmd url:http://test.y4tacker.top/identification.php User-Agent："><script>alert(`Hacked By Y4tacker`)</script><" POST: username=yyds&password=yyds&redirect=%2F&login=submit ``` Next, after the system administrator has logged in，and visit `http://xxx/admin.php?page=user_activity` ![7](https://user-images.githubusercontent.com/56486273/146197909-92fd89ba-7136-49fc-a13d-e803f8ce8634.png) and look it ![8](https://user-images.githubusercontent.com/56486273/146197926-a858933b-02cb-410f-b992-36d5dd119292.png) <!-- github-sync-id:1081062458 -->
adam closed this issue 2026-10-05 00:41:54 +02:00
adam commented 2026-10-05 00:41:55 +02:00
Author
Owner
Copy link
Copy source

Where's the fix?

Where's the fix? <!-- github-comment-id:1035640022 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1386