adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Reflected XSS in 'Add a Keyword' Function #2078

New Issue
Closed
opened 2026-10-05 01:05:37 +02:00 by adam · 1 comment
adam commented 2026-10-05 01:05:37 +02:00
Owner
Copy link
Copy source

The "Add a keyword" functionality on the page http://localhost/admin.php?page=tags contains an XSS vulnerability, allowing users to execute arbitrary JavaScript code through this feature. The severity of this issue is low.

Vulnerability Call Chain Analysis:

  1. admin\themes\default\template\tags.tpl
    This is the front-end page for the "Add a keyword" feature. The data filled in by the user is placed inside a form element with the ID 'add-tag'.
Image
  1. admin\themes\default\js\tags.js
    This form element triggers the following function upon submission:
Image
  1. admin\themes\default\js\tags.js #showMessage
    The showMessage function is called, and it uses the html function:
Image

The function inserts the user's input into the <p> tag inside the <info-error> element on the front-end page, leading to an XSS vulnerability.

Image

Attack Effect:

Image

Fix Recommendation:

In the showMessage function within admin\themes\default\js\tags.js, replace the html function with the text function:

Image

This change will prevent the XSS vulnerability from being triggered. The response page will be:

Image
The "**Add a keyword**" functionality on the page http://localhost/admin.php?page=tags contains an XSS vulnerability, allowing users to execute arbitrary JavaScript code through this feature. The severity of this issue is low. ### Vulnerability Call Chain Analysis: 1. **admin\themes\default\template\tags.tpl** This is the front-end page for the "Add a keyword" feature. The data filled in by the user is placed inside a form element with the ID 'add-tag'. <img width="1349" height="312" alt="Image" src="https://github.com/user-attachments/assets/1b5fd682-0bed-4428-964e-f094b9482ae0" /> 2. **admin\themes\default\js\tags.js** This form element triggers the following function upon submission: <img width="1245" height="547" alt="Image" src="https://github.com/user-attachments/assets/8ab5cd1f-e31d-4105-a551-1f5ed8b18319" /> 3. **admin\themes\default\js\tags.js #showMessage** The `showMessage` function is called, and it uses the `html` function: <img width="592" height="176" alt="Image" src="https://github.com/user-attachments/assets/326baab6-cbda-4e2d-81b4-4810f038f4aa" /> The function inserts the user's input into the `<p>` tag inside the `<info-error>` element on the front-end page, leading to an XSS vulnerability. <img width="2550" height="1299" alt="Image" src="https://github.com/user-attachments/assets/a3250f6b-fa42-47bd-91b8-df1e8299e5e5" /> ### Attack Effect: <img width="2540" height="735" alt="Image" src="https://github.com/user-attachments/assets/37d20070-6ae2-455c-b441-401765805420" /> ### Fix Recommendation: In the `showMessage` function within `admin\themes\default\js\tags.js`, replace the `html` function with the `text` function: <img width="605" height="174" alt="Image" src="https://github.com/user-attachments/assets/1982f695-dd17-4caa-9560-4d556e2abbdd" /> This change will prevent the XSS vulnerability from being triggered. The response page will be: <img width="2554" height="703" alt="Image" src="https://github.com/user-attachments/assets/64896d8f-53b0-4cdd-bf49-7528c2ba6e77" /> --- <!-- github-sync-id:3251313036 -->
adam closed this issue 2026-10-05 01:05:37 +02:00
adam commented 2026-10-05 01:05:38 +02:00
Author
Owner
Copy link
Copy source

What I see is only the possibility of adding a script in the input but then the script tags are well removed and above all you do this in the administration and Piwigo authorizes admins to put html in descriptions, titles etc....

What I see is only the possibility of adding a script in the input but then the script tags are well removed and above all you do this in the administration and Piwigo authorizes admins to put html in descriptions, titles etc.... <!-- github-comment-id:3143213318 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#2078