adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

File Inclusion #3 #535

New Issue
Closed
opened 2026-10-05 00:02:41 +02:00 by adam · 2 comments
adam commented 2026-10-05 00:02:41 +02:00
Owner
Copy link
Copy source

In Piwigo/admin/theme.php:

44: $filename = PHPWG_THEMES_PATH . $_GET['theme'] . '/admin/admin.inc.php'; 
47: include_once ($filename);

As you can see, a user-controlled variable theme is being used in an include call. this could be used for Remote Code Execution in older PHP versions where attacker can specify %00 (nullbytes) to make php ignore the following part (/admin/admin.inc.php)

Thanks

In Piwigo/admin/theme.php: ``` 44: $filename = PHPWG_THEMES_PATH . $_GET['theme'] . '/admin/admin.inc.php'; 47: include_once ($filename); ``` As you can see, a user-controlled variable theme is being used in an include call. this could be used for Remote Code Execution in older PHP versions where attacker can specify %00 (nullbytes) to make php ignore the following part (/admin/admin.inc.php) Thanks <!-- github-sync-id:196307673 -->
adam closed this issue 2026-10-05 00:02:41 +02:00
adam commented 2026-10-05 00:02:42 +02:00
Author
Owner
Copy link
Copy source

$_GET['theme'] must be in the $themes->fs_themes list, which is dynamically created:

    $dir = opendir(PHPWG_THEMES_PATH);

    while ($file = readdir($dir))
    {
      if ($file!='.' and $file!='..')
      {
        $path = PHPWG_THEMES_PATH.$file;
        if (is_dir($path)
            and preg_match('/^[a-zA-Z0-9-_]+$/', $file)
            and file_exists($path.'/themeconf.inc.php')
            )
        {

So I don't think it's possible to trick it easily :-)

$_GET['theme'] must be in the $themes->fs_themes list, which is dynamically created: ``` $dir = opendir(PHPWG_THEMES_PATH); while ($file = readdir($dir)) { if ($file!='.' and $file!='..') { $path = PHPWG_THEMES_PATH.$file; if (is_dir($path) and preg_match('/^[a-zA-Z0-9-_]+$/', $file) and file_exists($path.'/themeconf.inc.php') ) { ``` So I don't think it's possible to trick it easily :-) <!-- github-comment-id:267943505 -->
adam commented 2026-10-05 00:02:43 +02:00
Author
Owner
Copy link
Copy source

I think I maybe wrong about this one. I didn't see that part.

I think I maybe wrong about this one. I didn't see that part. <!-- github-comment-id:267975870 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#535