Mantis - Piwigo
Viewing Issue Advanced Details
702 security major always 2007.06.07 13:17 2007.09.20 21:03
rub  
rub  
urgent  
closed 1.7.0  
fixed  
none    
none 1.7.1  
any
Apache 1.3.x
0000702: Code Injection
Code Injection with picture comment

With guest user, it's possible to inject code on author field.

Example at moment:
http://demo.phpwebgallery.net/picture.php?/106/category/15 [^]
http://demo.phpwebgallery.net/picture.php?/128/category/15 [^]
set <script>alert('Hello World!');</script> as author
Issue History
2007.06.07 13:17 rub New Issue
2007.06.07 13:17 rub browser => any
2007.06.07 13:17 rub Web server => Apache 1.3.x
2007.06.07 13:19 rub Summary Code Injection with picture comment => Code Injection
2007.06.07 13:19 rub Description Updated
2007.06.07 13:19 rub Steps to Reproduce Updated
2007.06.07 13:22 rub Status new => acknowledged
2007.06.07 13:39 rub Status acknowledged => assigned
2007.06.07 13:39 rub Assigned To => rub
2007.06.07 13:45 rub Note Added: 0001881
2007.06.07 19:46 plg Note Added: 0001882
2007.06.07 19:58 rub Note Added: 0001883
2007.06.07 20:51 rub Status assigned => resolved
2007.06.07 20:51 rub Fixed in Version => 1.7.1
2007.06.07 20:51 rub Resolution open => fixed
2007.06.07 20:51 rub Note Added: 0001884
2007.06.07 20:52 rub Status resolved => closed
2007.09.20 21:01 VDigital Status closed => feedback
2007.09.20 21:01 VDigital Resolution fixed => reopened
2007.09.20 21:01 VDigital Note Added: 0001987
2007.09.20 21:02 VDigital View Status private => public
2007.09.20 21:03 VDigital Status feedback => closed
2007.09.20 21:03 VDigital Note Added: 0001988
2007.09.20 21:03 VDigital Resolution reopened => fixed

Notes
(0001881)
rub   
2007.06.07 13:45   
je commite ce soir une correction se basant sur le même principe que le contenu du commentaire:
add_event_handler('render_comment_content', 'htmlspecialchars');
(0001882)
plg   
2007.06.07 19:46   
Je préfererais un strip_tags
(0001883)
rub   
2007.06.07 19:58   
Pour l'auteur et aussi pour le contenu du commentaire?
(0001884)
rub   
2007.06.07 20:51   
[Subversion] r2030 & [Subversion] r2031

strip_tags uniquement sur auteur finalement
(0001987)
VDigital   
2007.09.20 21:01   
Just to make it public...
(0001988)
VDigital   
2007.09.20 21:03   
Can be seen as proof of already identified issue.