mirror of
https://github.com/Piwigo/Piwigo.git
synced 2026-10-31 06:02:00 +01:00
A issue I opened due to a misunderstanding #1966
Assignees
adam (Adam Wojcieszonek)
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: adam/Piwigo#1966
Reference in new issue
Block a user
Summary
The Configuration page of Piwigo version 14.5.0 has a stored XSS vulnerability, allowing users to modify the page_banner parameter on this page. This enables the execution of arbitrary script code when viewing newly created galleries on the Albums page.
Details
(1) The user inserts a malicious payload (e.g., <script>alert(document.cookie)</script>) into the “Page banner” parameter on the Configuration page and clicks the “Save Settings” button to save this information.
(2)Click the “visit the gallery” button on the Albums page. And then you'll see the vulnerability triggered.
(3)Attack result:
PoC
(1)First URL: http://localhost/piwigo/admin.php?page=configuration
(2)Request Method: Post
(3)Payload: <script>alert(document.cookie)</script>
(4)Second URL: http://localhost/piwigo/admin.php?page=albums
Impact
This vulnerability allows attackers to execute arbitrary script code, potentially exposing users' sensitive data and compromising the normal functioning of the software.
Hello, please read this comment : https://github.com/Piwigo/Piwigo/issues/2207#issuecomment-2308422197
Please take #2284 into account.
I sincerely apologize for my previous misjudgment—this issue should not have been considered a security vulnerability. I was new to cybersecurity back in 2024, so my understanding of security matters was still developing, and I appreciate your understanding.