mirror of
https://github.com/Piwigo/Piwigo.git
synced 2026-10-30 21:52:00 +01:00
[SECURITY] CSRF vulnerability in album email sending #2187
Assignees
adam (Adam Wojcieszonek)
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: adam/Piwigo#2187
Reference in new issue
Block a user
Description
Description
Version:
Piwigo 16.2.0
PHP: 8.2.4
MySQL: 10.4.28-MariaDB
The email sending feature of Piwigo 16.2.0 has a CSRF vulnerability that can be used to send phishing emails to groups or users via the administrator.
Here is the URL: (http://localhost/piwigo/admin.php?page=album-1-notification)
The problematic file is located in /admin/album_notification.php.
Normally, the pwg_token is validated to prevent CSRF attacks, but this php file does not validate the pwg_token.
Furthermore, the email body is included:
'CPL_CONTENT' => empty($_POST['mail_content']) ? '' : stripslashes($_POST['mail_content']),
This process does not perform escaping, so URLs can be embedded.
It is possible to display an alert like with XSS, but as scripts are disabled by default in modern email software, it may be more important to have phishing emails sent by the administrator.
Please make sure you can receive emails in advance.
Steps to reproduce:
With admin privileges, check the automatic login box, log in, go to album management, and add an album.
Go to "Edit Album" > "Notifications" and remember the page= parameter. (The number in the middle increments by 1 each time an album is created. In my case, I set it to "album-5-notification" because I created multiple albums.)
Create the CSRF payload.
Please change the action of the following to the respective URL.
‘’’
<html> <script> document.forms[0].submit(); </script> </html> ‘’’ Close the tab you had open earlier and view the CSRF HTML on the web. You should receive an email with text in the body that points to an external URL. proof of concept: https://github.com/user-attachments/files/24657901/Poc_csrf.pm4.zipHi @illilliinvite
You're writing about 2 very different "issues":
the fact that the PHP form validation script does not check the pwg_token, to prevent CSRF. I'm going to fix that easily.
the fact that an admin can send an email containing a link to users. I'm not going to fix that. An admin can do that. Why would that be a problem?
Thank you for your reply.
First of all, there is absolutely no need to fix issue 2. As for issue 1, it is certainly easy to fix, but I still consider it a vulnerability. In fact, the POC shows that a CSRF attack can be successful, so it can be considered a vulnerability.
Therefore, it would be more appropriate to call it a vulnerability rather than a bug, so I would appreciate it if you could add a "security" section if possible.