Bug Report: Cross Site Scripting(XSS) in page parameter of admin.php

[ghi5107]

Steps to reproduce:

1. Login to site as administrator;
2. Access following URL, browser will run any scripts posted to server, for example: alert(1) to prompt a dialog.
   http://host/Piwigo-master/admin.php?page=cehny"><script>alert(1)</script>tcs7a
   

Evironment:

• Win7

• Xampp (php mysql apache)

• Latest stable build(piwigo 2.9.0)

discovered by: ghi from Huawei WeiRan Labs

[ghi5107]

Do anyone confirm the issue??
I think xss vulnerabiltiy is harmful to administrator, attacker may steal information by enticing a administator to open a crafted web page.

[flop25]

Hello
you don't have a correct version of Piwigo. This has been sanitized
https://github.com/Piwigo/Piwigo/blob/master/admin.php#L114

[ghi5107]

hi, @flop25
But today, i download sourcecode from https://codeload.github.com/Piwigo/Piwigo/zip/master , and visit http://host/Piwigo-master/admin.php?page=cehny"><script>alert(1)</script>tcs7a, this issue still exist.
please confirm the issue, thank you.
reponse html (injected javascript code) as follow:

<a href="./admin.php?page=cehny"><script>alert(1)</script>tcs7a&amp;change_theme=1" class="tiptip" title="Switch to clear or dark colors for administration">

[flop25]

i couldn't execute anything


but seeing https://github.com/Piwigo/Piwigo/blob/master/admin.php#L108 doesn't make me comfortable
need some backup here ^^ @plegall @modus75

[ghi5107]

hi, @flop25
I think you could not execute anything because page parameter has been sanitized by your browser, not Piwigo. I test the issue by Internet explorer 11.

result for IE, chrome, firefox, as follows:

IE(execute javascript code)

Firfox(not execute anything)

chrome(not execute anything)

[fgeek]

CVE-2017-9452 has been assigned for this issue. Add it to commit message and ChangeLog file if/when you fix this issue. I do not think that CVE is needed if this was only in GitHub latest master package and not in any release (so maybe request it to be rejected). If needed I can also help verifying this issue.

[flop25]

@ghi5107 Thank you. During the night, I also thought about this since from the code it appears that nothing is sanitized