adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

File Inclusion Attack #2 #531

New Issue
Closed
opened 2026-10-05 00:02:26 +02:00 by adam · 1 comment
adam commented 2026-10-05 00:02:26 +02:00
Owner
Copy link
Copy source

There is a File Inclusion attack in the file Piwigo/admin/languages.php

34: $page['tab'] = $_GET['tab'];  //
46: include (PHPWG_ROOT_PATH . 'admin/languages_' . $page['tab'] . '.php');  // languages_installed.php

A user controlled variable is being sent straight to include(), this should have checks for allowed strings before that.

Thanks,

There is a File Inclusion attack in the file Piwigo/admin/languages.php ``` 34: $page['tab'] = $_GET['tab']; // 46: include (PHPWG_ROOT_PATH . 'admin/languages_' . $page['tab'] . '.php'); // languages_installed.php ``` A user controlled variable is being sent straight to include(), this should have checks for allowed strings before that. Thanks, <!-- github-sync-id:196307061 -->
adam closed this issue 2026-10-05 00:02:26 +02:00
adam commented 2026-10-05 00:02:27 +02:00
Author
Owner
Copy link
Copy source

use CVE-2016-10085 for this.

use CVE-2016-10085 for this. <!-- github-comment-id:267974558 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#531