Unsafe $_SERVER['QUERY_STRING'] usage in admin.php #939

New Issue

2026-10-05T00:24:41+02:00

adam commented

2026-10-05 00:24:41 +02:00

In admin.php @ line 102 we see the following code.

// +-----------------------------------------------------------------------+
// | Variables init                                                        |
// +-----------------------------------------------------------------------+

$change_theme_url = PHPWG_ROOT_PATH.'admin.php?';
$test_get = $_GET;
unset($test_get['page']);
unset($test_get['section']);
unset($test_get['tag']);
if (count($test_get) == 0 and !empty($_SERVER['QUERY_STRING']))
{
  $change_theme_url.= str_replace('&', '&amp;', $_SERVER['QUERY_STRING']).'&amp;';
}
$change_theme_url.= 'change_theme=1';

If we send Piwigo a url like:

admin.php?="><script>alert(1);</script>

The condition at line 111 will be met and the $change_theme_url variable will then contain an unsanitized query string resulting in XSS wherever $change_theme_url is used.

In admin.php @ line 102 we see the following code. ```php // +-----------------------------------------------------------------------+ // | Variables init | // +-----------------------------------------------------------------------+ $change_theme_url = PHPWG_ROOT_PATH.'admin.php?'; $test_get = $_GET; unset($test_get['page']); unset($test_get['section']); unset($test_get['tag']); if (count($test_get) == 0 and !empty($_SERVER['QUERY_STRING'])) { $change_theme_url.= str_replace('&', '&', $_SERVER['QUERY_STRING']).'&'; } $change_theme_url.= 'change_theme=1'; ``` If we send Piwigo a url like: admin.php?="><script>alert(1);</script> The condition at line 111 will be met and the $change_theme_url variable will then contain an unsanitized query string resulting in XSS wherever $change_theme_url is used.

Sign in to join this conversation.

master

issue-2560-people

translation

16.x

feat/embedding-based-contextual-tagging

issue-2576-search-include-ai-in-search-results

feat/search-ocr-ai

issue-2391-update-menu-design

15.x

detect-container

issue-2386-update-filters-users-activity

issue-2362-add-filters-options-in-admin

issue-2367-imagemagick7

issue-2225-quicksearch-help

14.x

issue-2164-BatchManagerUnitMode-Redesign

13.x

12.x

issue-1657-SVG_Support

issue-1703-historySearchMethod

11.x

2.10

2.9

2.8

2.7

2.5

2.6

2.4

2.3

2.2

2.1

2.0

1.7

1.3

1.6

1.5

1.4

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/Piwigo#939