282 matches found
Server-side Request Forgery (SSRF)
Piwik is vulnerable to server-side request forgery SSRF attacks. These attacks are possible through a flaw in the DisplayTopKeywords function in plugins/Referrers/Controller.php which allows attackers to inject PHP objects and execute arbitrary code...
Information Disclosure
piwik is susceptible to information disclosure. The library logs admin features using ajax requests with GET parameters rather than POST parameters. This can allow a malicious user with access to the logs to obtain sensitive information like tokenauth...
Cross-site Scripting (XSS)
piwik is vulnerable to cross-site scripting XSS attacks. It is possible because it does not prevent the attackers from injecting web script or HTML...
Piwik Remote Code Execution Vulnerability
Piwik formerly known as phpMyVisites is an open source website access statistics system based on PHP5 and MySQL. A remote code execution vulnerability exists in Piwik. An attacker could exploit this vulnerability to execute arbitrary script code in an affected application...
Piwik Superuser Unauthorized File Upload
A file upload vulnerability exists in Piwik. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Piwik 2.14.0/2.16.0/2.17.1/3.0.1 - Superuser Plugin Upload (Metasploit)
This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' class MetasploitModule 'Piwik Superuser Plugin Upload', 'Description' = %q This module will generate a plugin, pack the payload...
Piwik 2.14.0 / 2.16.0 / 2.17.1 / 3.0.1 - Superuser Plugin Upload Exploit
Exploit for php platform in category remote exploits This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' class MetasploitModule 'Piwik Superuser Plugin Upload', 'Description' = %q...
Piwik Superuser Plugin Upload
This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' class MetasploitModule 'Piwik Superuser Plugin Upload', 'Description' = %q This module will generate a plugin, pack the payload...
Piwik Superuser Plugin Upload
This module will generate a plugin, pack the payload into it and upload it to a server running Piwik. Superuser Credentials are required to run this module. This module does not work against Piwik 1 as there is no option to upload custom plugins. Piwik disabled custom plugin uploads in version...
Piwik PHP Object Injection Vulnerability
Piwik formerly known as phpMyVisites is an open source website access statistics system based on PHP5 and MySQL. A security vulnerability exists in the 'saveLayout' function in the /plugins/Dashboard/Controller.php script in Piwik 2.16.0 and earlier versions. A remote attacker can exploit this...
Piwik <= 2.16.0 (saveLayout) PHP object injection vulnerability
The vulnerability can be triggered through the saveLayout method defined in /plugins/Dashboard/Controller.php: 210. public function saveLayout 211. 212. $this-checkTokenInUrl; 213. 214. $layout = Common::unsanitizeInputValueCommon::getRequestVar'layout'; 215. $layout = striptags$layout; 216...
Piwik 2.16.0 - (layout) PHP Object Injection Vulnerability
Exploit for php platform in category web applications --------------------------------------------------------------- Piwik checkTokenInUrl; 213. 214. $layout = Common::unsanitizeInputValueCommon::getRequestVar'layout'; 215. $layout = striptags$layout; 216. $idDashboard =...
Piwik 2.16.0 PHP Object Injection
--------------------------------------------------------------- Piwik checkTokenInUrl; 213. 214. $layout = Common::unsanitizeInputValueCommon::getRequestVar'layout'; 215. $layout = striptags$layout; 216. $idDashboard = Common::getRequestVar'idDashboard', 1, 'int'; 217. $name =...
Piwik 2.16.0 - layout PHP Object Injection
Piwik 2.16.0 - layout PHP Object Injection --------------------------------------------------------------- Piwik checkTokenInUrl; 213. 214. $layout = Common::unsanitizeInputValueCommon::getRequestVar'layout'; 215. $layout = striptags$layout; 216. $idDashboard = Common::getRequestVar'idDashboard',...
Piwik 2.16.0 - 'layout' PHP Object Injection
--------------------------------------------------------------- Piwik checkTokenInUrl; 213. 214. $layout = Common::unsanitizeInputValueCommon::getRequestVar'layout'; 215. $layout = striptags$layout; 216. $idDashboard = Common::getRequestVar'idDashboard', 1, 'int'; 217. $name =...
WordPress Piwik Plugin <= 1.0.9 - Persistent Cross Site Scripting
Because of this vulnerability, anyone can change the plugin’s settings and through those settings add malicious JavaScript code to the website’s page. Solution Update the plugin...
Drupal Piwik Web Analytics Module Cross-Site Scripting Vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Piwik Web Analytics is one of the Piwik web traffic analysis modules. A cross-site scripting vulnerability exists in the Drupal Piwik Web Analytics module in versions 7.x-2.x prior to...
FreeBSD : piwik -- XSS vulnerability (28bf62ef-5e2c-11e6-a15f-00248c0c745d)
Piwik reports : We have identified and fixed several XSS security issues in this release. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributo...
Piwik - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-043
This module enables you to add integration with Piwik statistics service. The module allows admin users to enter custom JavaScript snippets to add advanced tracking functionality. The permission required to enter this JavaScript was not marked as restricted. This vulnerability is mitigated by the...
