adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-31 06:02:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Cross Site Scirpting #2 #534

New Issue
Closed
opened 2026-10-05 00:02:37 +02:00 by adam · 3 comments
adam commented 2026-10-05 00:02:37 +02:00
Owner
Copy link
Copy source

In Piwigo/admin/site_update.php

46: $site_id = $_GET['site']; 
55: die ('site ' . $site_id . ' does not exist');

Unsanitized GET paramenter site is being sent to die() without no santization
Fix: use htmlentities();

Thanks,

In Piwigo/admin/site_update.php ``` 46: $site_id = $_GET['site']; 55: die ('site ' . $site_id . ' does not exist'); ``` Unsanitized GET paramenter site is being sent to die() without no santization Fix: use htmlentities(); Thanks, <!-- github-sync-id:196307554 -->
adam closed this issue 2026-10-05 00:02:37 +02:00
adam commented 2026-10-05 00:02:38 +02:00
Author
Owner
Copy link
Copy source

Can you give us an example when it can be problematic?

Can you give us an example when it can be problematic? <!-- github-comment-id:267944785 -->
adam commented 2026-10-05 00:02:39 +02:00
Author
Owner
Copy link
Copy source

@plegall that code is equivallent to:
die ('site ' . $_GET['site']; . ' does not exist');

Which can be used to perform XSS by sending parameters like:

http://localhost/tez.php?site=%3Csvg/onload=alert%28document.cookie%29%3E%3C/svg%3E

^ that will alert your cookies in Firefox.

you can use htmlentities() on $site_id it will sanitize it. example:

46: $site_id = htmlentities($_GET['site'],ENT_QUOTES);

Thanks,

@plegall that code is equivallent to: `die ('site ' . $_GET['site']; . ' does not exist'); ` Which can be used to perform XSS by sending parameters like: http://localhost/tez.php?site=%3Csvg/onload=alert%28document.cookie%29%3E%3C/svg%3E ^ that will alert your cookies in Firefox. you can use htmlentities() on $site_id it will sanitize it. example: 46: $site_id = htmlentities($_GET['site'],ENT_QUOTES); Thanks, <!-- github-comment-id:267977288 -->
adam commented 2026-10-05 00:02:40 +02:00
Author
Owner
Copy link
Copy source

Thanks for your example.

Actually, in admin/site_update.php I find:

if (!is_numeric($_GET['site']))
{
  die ('site param missing or invalid');
}
$site_id = $_GET['site'];

is that not safe?

Thanks for your example. Actually, in admin/site_update.php I find: ``` if (!is_numeric($_GET['site'])) { die ('site param missing or invalid'); } $site_id = $_GET['site']; ``` is that not safe? <!-- github-comment-id:268240892 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#534