adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Bug Report: Cross Site Scripting(XSS) in page parameter of admin.php #614

New Issue
Closed
opened 2026-10-05 00:07:26 +02:00 by adam · 7 comments
adam commented 2026-10-05 00:07:26 +02:00
Owner
Copy link
Copy source

Steps to reproduce:

  1. Login to site as administrator;
  2. Access following URL, browser will run any scripts posted to server, for example: alert(1) to prompt a dialog.
    http://host/Piwigo-master/admin.php?page=cehny"><script>alert(1)</script>tcs7a
    default

Evironment:

  • Win7

  • Xampp (php mysql apache)

  • Latest stable build(piwigo 2.9.0)

discovered by: ghi from Huawei WeiRan Labs

# **Steps to reproduce:** 1. Login to site as administrator; 2. Access following URL, browser will run any scripts posted to server, for example: alert(1) to prompt a dialog. http://host/Piwigo-master/admin.php?page=cehny"><script>alert(1)</script>tcs7a ![default](https://cloud.githubusercontent.com/assets/18000135/26664001/2d50b39c-46c1-11e7-8e51-fbae2d0f29ba.png) # Evironment: - Win7 - Xampp (php mysql apache) - Latest stable build(piwigo 2.9.0) discovered by: ghi from Huawei WeiRan Labs <!-- github-sync-id:226161894 -->
adam closed this issue 2026-10-05 00:07:26 +02:00
adam commented 2026-10-05 00:07:27 +02:00
Author
Owner
Copy link
Copy source

Do anyone confirm the issue??
I think xss vulnerabiltiy is harmful to administrator, attacker may steal information by enticing a administator to open a crafted web page.

Do anyone confirm the issue?? I think xss vulnerabiltiy is harmful to administrator, attacker may steal information by enticing a administator to open a crafted web page. <!-- github-comment-id:305681677 -->
adam commented 2026-10-05 00:07:27 +02:00
Author
Owner
Copy link
Copy source

Hello
you don't have a correct version of Piwigo. This has been sanitized
https://github.com/Piwigo/Piwigo/blob/master/admin.php#L114

Hello you don't have a correct version of Piwigo. This has been sanitized https://github.com/Piwigo/Piwigo/blob/master/admin.php#L114 <!-- github-comment-id:306605133 -->
adam commented 2026-10-05 00:07:28 +02:00
Author
Owner
Copy link
Copy source

hi, @flop25
But today, i download sourcecode from https://codeload.github.com/Piwigo/Piwigo/zip/master , and visit http://host/Piwigo-master/admin.php?page=cehny"><script>alert(1)</script>tcs7a, this issue still exist.
please confirm the issue, thank you.
reponse html (injected javascript code) as follow:

<a href="./admin.php?page=cehny"><script>alert(1)</script>tcs7a&amp;change_theme=1" class="tiptip" title="Switch to clear or dark colors for administration">

hi, @flop25 But today, i download sourcecode from https://codeload.github.com/Piwigo/Piwigo/zip/master , and visit http://host/Piwigo-master/admin.php?page=cehny"><script>alert(1)</script>tcs7a, this issue still exist. please confirm the issue, thank you. reponse html (injected javascript code) as follow: `<a href="./admin.php?page=cehny"><script>alert(1)</script>tcs7a&amp;change_theme=1" class="tiptip" title="Switch to clear or dark colors for administration">` <!-- github-comment-id:306672619 -->
adam commented 2026-10-05 00:07:29 +02:00
Author
Owner
Copy link
Copy source

i couldn't execute anything
2017-06-07_05-10-49
2017-06-07_05-07-57
but seeing https://github.com/Piwigo/Piwigo/blob/master/admin.php#L108 doesn't make me comfortable
need some backup here ^^ @plegall @modus75

i couldn't execute anything ![2017-06-07_05-10-49](https://user-images.githubusercontent.com/736909/26860728-d4724f1e-4b3f-11e7-8835-a2453ad5aff8.jpg) ![2017-06-07_05-07-57](https://user-images.githubusercontent.com/736909/26860729-d47b9cd6-4b3f-11e7-9eed-5159f3868a20.jpg) but seeing https://github.com/Piwigo/Piwigo/blob/master/admin.php#L108 doesn't make me comfortable need some backup here ^^ @plegall @modus75 <!-- github-comment-id:306675150 -->
adam commented 2026-10-05 00:07:30 +02:00
Author
Owner
Copy link
Copy source

hi, @flop25
I think you could not execute anything because page parameter has been sanitized by your browser, not Piwigo. I test the issue by Internet explorer 11.

result for IE, chrome, firefox, as follows:

IE(execute javascript code)

ie

Firfox(not execute anything)

firfox

chrome(not execute anything)

chrome

hi, @flop25 I think you could not execute anything because page parameter has been sanitized by your browser, not Piwigo. I test the issue by Internet explorer 11. # result for IE, chrome, firefox, as follows: ## IE(execute javascript code) ![ie](https://user-images.githubusercontent.com/18000135/26865640-346169aa-4b90-11e7-8d7e-a0bc49a26f33.JPG) ## Firfox(not execute anything) ![firfox](https://user-images.githubusercontent.com/18000135/26865671-55e2f058-4b90-11e7-840c-d7ac9994e1c0.JPG) ## chrome(not execute anything) ![chrome](https://user-images.githubusercontent.com/18000135/26865689-673072ea-4b90-11e7-87d6-e6838e16c501.JPG) <!-- github-comment-id:306703294 -->
adam commented 2026-10-05 00:07:31 +02:00
Author
Owner
Copy link
Copy source

CVE-2017-9452 has been assigned for this issue. Add it to commit message and ChangeLog file if/when you fix this issue. I do not think that CVE is needed if this was only in GitHub latest master package and not in any release (so maybe request it to be rejected). If needed I can also help verifying this issue.

CVE-2017-9452 has been assigned for this issue. Add it to commit message and ChangeLog file if/when you fix this issue. I do not think that CVE is needed if this was only in GitHub latest master package and not in any release (so maybe request it to be rejected). If needed I can also help verifying this issue. <!-- github-comment-id:306707379 -->
adam commented 2026-10-05 00:07:31 +02:00
Author
Owner
Copy link
Copy source

@ghi5107 Thank you. During the night, I also thought about this since from the code it appears that nothing is sanitized

@ghi5107 Thank you. During the night, I also thought about this since from the code it appears that nothing is sanitized <!-- github-comment-id:306754631 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#614