adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

File Inclusion with Possible RCE #532

New Issue
Closed
opened 2026-10-05 00:02:28 +02:00 by adam · 5 comments
adam commented 2026-10-05 00:02:28 +02:00
Owner
Copy link
Copy source

In Piwigo/admin/plugin.php

32: $sections = explode('/', $_GET['section']); 
59: $filename = PHPWG_PLUGINS_PATH . implode('/', $sections); 
60: if(is_file($filename))
62: include_once ($filename);

As you can see, a user-controlled variable is being sent stright to include_once(). a person who managed to upload a .jpg file or any other content with PHP paylaod will just need to refer to that location and include_once() will execute it, making a code execution possible.

In Piwigo/admin/plugin.php ``` 32: $sections = explode('/', $_GET['section']); 59: $filename = PHPWG_PLUGINS_PATH . implode('/', $sections); 60: if(is_file($filename)) 62: include_once ($filename); ``` As you can see, a user-controlled variable is being sent stright to include_once(). a person who managed to upload a .jpg file or any other content with PHP paylaod will just need to refer to that location and include_once() will execute it, making a code execution possible. <!-- github-sync-id:196307361 -->
adam closed this issue 2026-10-05 00:02:28 +02:00
adam commented 2026-10-05 00:02:29 +02:00
Author
Owner
Copy link
Copy source

There are quite some security checks before including anything. Uploading a JPEG in the "upload" directory won't be able to get his file included. You can't have ".." as part of the $sections, for example.

There are quite some security checks before including anything. Uploading a JPEG in the "upload" directory won't be able to get his file included. You can't have ".." as part of the $sections, for example. <!-- github-comment-id:267938358 -->
adam commented 2026-10-05 00:02:30 +02:00
Author
Owner
Copy link
Copy source

Hey @plegall,

If you are implying:

if (!preg_match('/^[\w-]+$/', $plugin_id))
{
  die('Invalid plugin identifier');
}

As a security fix, it isn't sufficent because it only sanitizes $plugin_id = $sections[0];

How about other $secution[i] other than [0]? they aren't sanitized, we just have to send in another array. all the security checks apply to the $plugin_id which is just the first occurance of $sections.

Thanks,

Hey @plegall, If you are implying: ``` if (!preg_match('/^[\w-]+$/', $plugin_id)) { die('Invalid plugin identifier'); } ``` As a security fix, it isn't sufficent because it only sanitizes $plugin_id = $sections[0]; How about other $secution[i] other than [0]? they aren't sanitized, we just have to send in another array. all the security checks apply to the $plugin_id which is just the first occurance of $sections. Thanks, <!-- github-comment-id:267975534 -->
adam commented 2026-10-05 00:02:30 +02:00
Author
Owner
Copy link
Copy source
$sections = explode('/', $_GET['section'] );
for ($i=0; $i<count($sections); $i++)
{
  if (empty($sections[$i]) or $sections[$i]=='..')
  {
    unset($sections[$i]);
    $i--;
  }
}

No part of the $sections can be ".."

``` $sections = explode('/', $_GET['section'] ); for ($i=0; $i<count($sections); $i++) { if (empty($sections[$i]) or $sections[$i]=='..') { unset($sections[$i]); $i--; } } ``` No part of the $sections can be ".." <!-- github-comment-id:268241924 -->
adam commented 2026-10-05 00:02:31 +02:00
Author
Owner
Copy link
Copy source

@plegall not good enough. because that checks if $sections[i] is exactly "..", which is sad cause attackers can send in /..// or /..%2F and the $sections[$i]=='..' will return false. I suggest you doing a preg_replace() on it rather that one. tis easy to jump.

@plegall not good enough. because that checks if $sections[i] is exactly "..", which is sad cause attackers can send in /..// or /..%2F and the $sections[$i]=='..' will return false. I suggest you doing a preg_replace() on it rather that one. tis easy to jump. <!-- github-comment-id:268259053 -->
adam commented 2026-10-05 00:02:32 +02:00
Author
Owner
Copy link
Copy source

Use CVE-2016-10105 for this.

Use CVE-2016-10105 for this. <!-- github-comment-id:270076108 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#532