adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

[security] quick search and criteria display #519

New Issue
Closed
opened 2026-10-05 00:02:01 +02:00 by adam · 6 comments
adam commented 2026-10-05 00:02:01 +02:00
Owner
Copy link
Copy source

We need to sanitize search criteria used in quick search before displaying on search_rules.php page.

Reported by @BlueTower

We need to sanitize search criteria used in quick search before displaying on search_rules.php page. Reported by @BlueTower <!-- github-sync-id:192284010 -->
adam closed this issue 2026-10-05 00:02:01 +02:00
adam commented 2026-10-05 00:02:02 +02:00
Author
Owner
Copy link
Copy source

related to #548

related to #548 <!-- github-comment-id:263572084 -->
adam commented 2026-10-05 00:02:02 +02:00
Author
Owner
Copy link
Copy source

CVE-2016-9751 identifier has been assigned for this vulnerability.

CVE-2016-9751 identifier has been assigned for this vulnerability. <!-- github-comment-id:268800063 -->
adam commented 2026-10-05 00:02:03 +02:00
Author
Owner
Copy link
Copy source

Hello @plegall -

I believe this issue needs to reopened. I am still able to execute a payload on (http://piwigo.org/demo/search_rules.php?search_id=38739) using a payload such as:

<svg onload=alert&#40;1&#41>

Suggestions?

Hello @plegall - I believe this issue needs to reopened. I am still able to execute a payload on (http://piwigo.org/demo/search_rules.php?search_id=38739) using a payload such as: `<svg onload=alert&#40;1&#41>` Suggestions? <!-- github-comment-id:278468787 -->
adam commented 2026-10-05 00:02:04 +02:00
Author
Owner
Copy link
Copy source

@plegall Any comments? Can you take a new look and fix this in 2.9.3?

@plegall Any comments? Can you take a new look and fix this in 2.9.3? <!-- github-comment-id:334922650 -->
adam commented 2026-10-05 00:02:05 +02:00
Author
Owner
Copy link
Copy source

Can anyone reproduce? I've tested for XSS many times (not just in piwigo), and the piwigo.org link by bluetower isn't showing any alert. Tested in Firefox, where XSS should work.

Can anyone reproduce? I've tested for XSS many times (not just in piwigo), and the piwigo.org link by bluetower isn't showing any alert. Tested in Firefox, where XSS should work. <!-- github-comment-id:336604690 -->
adam commented 2026-10-05 00:02:05 +02:00
Author
Owner
Copy link
Copy source

I can't reproduce neither. I close this already closed bug.

I can't reproduce neither. I close this already closed bug. <!-- github-comment-id:367374086 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#519