PT-2024-21380 · Piwigo · Piwigo

Imthatt · Published 2024-02-28 · Updated 2025-05-13 · CVE-2024-26450

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 14.2.0

Description An issue exists within Piwigo allowing a malicious user to take over the application. This exploit involves chaining a Cross Site Request Forgery vulnerability to issue a Stored Cross Site Scripting payload stored within an Admin user's dashboard, executing remote JavaScript. This can be used to upload a new PHP file under an administrator and directly call that file from the victim's instance to connect back to a malicious listener. The vulnerability can also be used by a remote attacker to escalate privileges via the batch function on the admin page.

Recommendations For versions prior to 14.2.0, update to version 14.2.0 or later to resolve the issue. As a temporary workaround, consider disabling the batch function on the admin page and restricting access to the admin dashboard to minimize the risk of exploitation. Avoid using the application's admin features until the issue is resolved.

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2024-26450

GHSA-P362-CFPJ-Q55F

Affected Products

Piwigo

References · 9

• https://github.com/Piwigo/Piwigo/security/advisories/GHSA-p362-cfpj-q55f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-26450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26450 · Security Note
• https://t.me/cvenotify/103057 · Telegram Post
• https://t.me/cvenotify/121954 · Telegram Post
• https://t.me/cvenotify/73430 · Telegram Post
• https://t.me/cvenotify/72607 · Telegram Post
• https://twitter.com/CVEnew/status/1762959065448337450 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1762987421321359392 · Twitter Post