adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Bug Report: LocalFiles Editor Tools Cause Remote Code Execution #664

New Issue
Closed
opened 2026-10-05 00:10:11 +02:00 by adam · 6 comments
adam commented 2026-10-05 00:10:11 +02:00
Owner
Copy link
Copy source

Steps to reproduce:

  1. Activate LocalFiles Editor Tools

image

  1. Write a shell script file

image

  1. Now you can execute commands on this server

image

image

  1. Fix advices

disable_functions in /etc/php.ini
Prohibited to use dangerous functions like
phpinfo,eval,passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,fsocket,fsockopen

discovered by: topsec(lizhiqiang)

# Steps to reproduce: 1. Activate LocalFiles Editor Tools ![image](https://user-images.githubusercontent.com/16974004/27491583-93f8f51c-5875-11e7-80e2-20f7497d1d59.png) 2. Write a shell script file ![image](https://user-images.githubusercontent.com/16974004/27491594-9f25ccc6-5875-11e7-82ea-a46ac45dbf80.png) 3. Now you can execute commands on this server ![image](https://user-images.githubusercontent.com/16974004/27491677-eb469bda-5875-11e7-981e-c48aa431a3e3.png) ![image](https://user-images.githubusercontent.com/16974004/27491668-e7bf624e-5875-11e7-91ce-5408ab12637c.png) 4. Fix advices disable_functions in /etc/php.ini Prohibited to use dangerous functions like phpinfo,eval,passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,fsocket,fsockopen discovered by: topsec(lizhiqiang) <!-- github-sync-id:238196920 -->
adam closed this issue 2026-10-05 00:10:11 +02:00
adam commented 2026-10-05 00:10:12 +02:00
Author
Owner
Copy link
Copy source

Hi @Akityo nice report. Actually it's not a bug, it's a feature. LocalFiles Editor let you write some PHP code and it's executed by Piwigo. No more dangerous than giving the webmaster the ability to install a plugin.

Hi @Akityo nice report. Actually it's not a bug, it's a feature. LocalFiles Editor let you write some PHP code and it's executed by Piwigo. No more dangerous than giving the webmaster the ability to install a plugin. <!-- github-comment-id:310836476 -->
adam commented 2026-10-05 00:10:13 +02:00
Author
Owner
Copy link
Copy source

@plegall fine, that's no't a bug ; in addition i hope those dangerous functions could be disable.

@plegall fine, that's no't a bug ; in addition i hope those dangerous functions could be disable. <!-- github-comment-id:310892744 -->
adam commented 2026-10-05 00:10:13 +02:00
Author
Owner
Copy link
Copy source

Why would they be disabled? The code added by LocalFiles Editor is no more harmful than the code added with a plugin. Disabling those functions is a decision for the hoster. Disabling those functions will be problematic to run Piwigo.

Why would they be disabled? The code added by LocalFiles Editor is no more harmful than the code added with a plugin. Disabling those functions is a decision for the hoster. Disabling those functions will be problematic to run Piwigo. <!-- github-comment-id:310893666 -->
adam commented 2026-10-05 00:10:14 +02:00
Author
Owner
Copy link
Copy source

In my opinion WebAPP just like a sandbox , some webserver will install a lot of WebAPP, If one of those WebAPP could get The System Shell , will be affect to others WebAPP . Just advises that It shouldn't giving that powerful privilege. like what you said before ,there are No more dangerous than giving the webmaster the ability to install a plugin.

In my opinion WebAPP just like a sandbox , some webserver will install a lot of WebAPP, If one of those WebAPP could get The System Shell , will be affect to others WebAPP . Just advises that It shouldn't giving that powerful privilege. like what you said before ,there are No more dangerous than giving the webmaster the ability to install a plugin. <!-- github-comment-id:310894239 -->
adam commented 2026-10-05 00:10:15 +02:00
Author
Owner
Copy link
Copy source

What I say is that code in plugins or added by LocalFiles Editor is just as powerful/harmful as the code in Piwigo core.

The real problem is that an "unexpected" person may get an access to the administration. Not that the administration gives a lot of power.

What I say is that code in plugins or added by LocalFiles Editor is just as powerful/harmful as the code in Piwigo core. The real problem is that an "unexpected" person may get an access to the administration. Not that the administration gives a lot of power. <!-- github-comment-id:310894606 -->
adam commented 2026-10-05 00:10:16 +02:00
Author
Owner
Copy link
Copy source

Ok , I get it . Have a nice day ,bro .

Ok , I get it . Have a nice day ,bro . <!-- github-comment-id:310895071 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#664