An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application. This exploit involves chaining a Cross Site Request Forgery vulnerability to issue a Stored Cross Site Scripting payload stored within an Admin user's dashboard, executing remote JavaScript. This can be used to upload a new PHP file under an administrator and directly call that file from the victim's instance to connect back to a malicious listener.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/Piwigo/Piwigo/security/advisories/GHSA-p362-cfpj-q55f | Vendor Advisory |
| https://github.com/Piwigo/Piwigo/security/advisories/GHSA-p362-cfpj-q55f | Vendor Advisory |
Configurations
History
13 May 2025, 14:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Piwigo/Piwigo/security/advisories/GHSA-p362-cfpj-q55f - Vendor Advisory | |
| CPE | cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:* | |
| First Time |
Piwigo piwigo
Piwigo |
09 Mar 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application. This exploit involves chaining a Cross Site Request Forgery vulnerability to issue a Stored Cross Site Scripting payload stored within an Admin user's dashboard, executing remote JavaScript. This can be used to upload a new PHP file under an administrator and directly call that file from the victim's instance to connect back to a malicious listener. |
28 Feb 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-28 22:15
Updated : 2025-05-13 14:59
NVD link : CVE-2024-26450
Mitre link : CVE-2024-26450
JSON object : View
Products Affected
piwigo
- piwigo
CWE
No CWE.