adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Cross Site Scripting #533

New Issue
Closed
opened 2026-10-05 00:02:33 +02:00 by adam · 3 comments
adam commented 2026-10-05 00:02:33 +02:00
Owner
Copy link
Copy source

In Piwigo/admin/plugin.php

32: $sections = explode('/', $_GET['section']); 
59: $filename = PHPWG_PLUGINS_PATH . implode('/', $sections); 
66: die ('Missing file ' . $filename);

As you can see a user-controlled input $_GET['section'] ($filename) is being sent to die() - printing out without no sanitization, this could result in cross-site scripting because die() prints out content just like echo() before exit.

Fix: do htmlentities($filename);

In Piwigo/admin/plugin.php ``` 32: $sections = explode('/', $_GET['section']); 59: $filename = PHPWG_PLUGINS_PATH . implode('/', $sections); 66: die ('Missing file ' . $filename); ``` As you can see a user-controlled input $_GET['section'] ($filename) is being sent to die() - printing out without no sanitization, this could result in cross-site scripting because die() prints out content just like echo() before exit. Fix: do htmlentities($filename); <!-- github-sync-id:196307456 -->
adam closed this issue 2026-10-05 00:02:33 +02:00
adam commented 2026-10-05 00:02:34 +02:00
Author
Owner
Copy link
Copy source

earlier in this file, you can find:

check_status(ACCESS_ADMINISTRATOR);

So only Piwigo administrators can exploit this "security issue". Is that really a problem?

earlier in this file, you can find: ``` check_status(ACCESS_ADMINISTRATOR); ``` So only Piwigo administrators can exploit this "security issue". Is that really a problem? <!-- github-comment-id:268242347 -->
adam commented 2026-10-05 00:02:35 +02:00
Author
Owner
Copy link
Copy source

should be. because attacker would only need to give the admin a malicious xss link, and when authorized admin visits it, check_status(ACCESS_ADMINISTRATOR); will return to true. so yes it is as dangerous.

should be. because attacker would only need to give the admin a malicious xss link, and when authorized admin visits it, check_status(ACCESS_ADMINISTRATOR); will return to true. so yes it is as dangerous. <!-- github-comment-id:268256015 -->
adam commented 2026-10-05 00:02:36 +02:00
Author
Owner
Copy link
Copy source

Use CVE-2016-10083 for this.

Use CVE-2016-10083 for this. <!-- github-comment-id:269788741 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#533