Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php.
I found that piwigo Front-End can trigger xss，it means when the system administrator can trigger xss after logging into the backend

Please see below for details of the analysis

at first，We found a global filter in `include/common.inc.php`


![1](https://user-images.githubusercontent.com/56486273/146197712-471df1d4-2d90-4a14-aea1-9f25d12414bd.png)


it just handle GET, POST, COOKIE，then we can think whether it can be broken through other parameters

Then I found out that piwigo records the user's login and logout process

Take the exit process as an example(The login is also the same)，in `include/functions_user.inc.php`

```php
function logout_user()
{
  global $conf;

  trigger_notify('user_logout', @$_SESSION['pwg_uid']);
  pwg_activity('user', @$_SESSION['pwg_uid'], 'logout');

  $_SESSION = array();
  session_unset();
  session_destroy();
  setcookie(session_name(),'',0,
      ini_get('session.cookie_path'),
      ini_get('session.cookie_domain')
    );
  setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain'));
}
```

After that, let's see what the `pwg_activity` function does in `include/functions.inc.php`

in this function，There is no filter parameter `$_SERVER['HTTP_USER_AGENT']`



![2](https://user-images.githubusercontent.com/56486273/146197730-c50fbedc-3493-4578-88f8-d133ff3d0679.png)

then execute serialize and pwg_db_real_escape_string functions respectively



![3](https://user-images.githubusercontent.com/56486273/146197780-bb7b5034-9e65-4838-9dec-86f1d888e10b.png)

look at function(pwg_db_real_escape_string),it just prevent sql injection

```php
function pwg_db_real_escape_string($s)
{
  return mysql_real_escape_string($s);
}
```

then we register a user`yyds\yyds`


![4](https://user-images.githubusercontent.com/56486273/146197857-7db7d57f-4fe7-4571-a2aa-f055acf0c318.png)


then we click `logout`


![5](https://user-images.githubusercontent.com/56486273/146197874-1fb0bf17-1a84-41d4-ae11-0b1e1442f860.png)



then we just post like this，It is best to send more packages


![6](https://user-images.githubusercontent.com/56486273/146197891-df638a27-76c9-472f-97e3-bee9661abdd0.png)


```cmd
url:http://test.y4tacker.top/identification.php
User-Agent："><script>alert(`Hacked By Y4tacker`)</script><"
POST:
username=yyds&password=yyds&redirect=%2F&login=submit
```

Next, after the system administrator has logged in，and visit `http://xxx/admin.php?page=user_activity`
![7](https://user-images.githubusercontent.com/56486273/146197909-92fd89ba-7136-49fc-a13d-e803f8ce8634.png)



and look it

![8](https://user-images.githubusercontent.com/56486273/146197926-a858933b-02cb-410f-b992-36d5dd119292.png)


[Version <= 12.1.0]XSS vulnerability in the frontend
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : [Version <= 12.1.0]XSS vulnerability in the frontend
Issue date:

--- start body ---
I found that piwigo Front-End can trigger xss，it means when the system administrator can trigger xss after logging into the backend

Please see below for details of the analysis

at first，We found a global filter in `include/common.inc.php`


![1](https://user-images.githubusercontent.com/56486273/146197712-471df1d4-2d90-4a14-aea1-9f25d12414bd.png)


it just handle GET, POST, COOKIE，then we can think whether it can be broken through other parameters

Then I found out that piwigo records the user's login and logout process

Take the exit process as an example(The login is also the same)，in `include/functions_user.inc.php`

```php
function logout_user()
{
  global $conf;

  trigger_notify('user_logout', @$_SESSION['pwg_uid']);
  pwg_activity('user', @$_SESSION['pwg_uid'], 'logout');

  $_SESSION = array();
  session_unset();
  session_destroy();
  setcookie(session_name(),'',0,
      ini_get('session.cookie_path'),
      ini_get('session.cookie_domain')
    );
  setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain'));
}
```

After that, let's see what the `pwg_activity` function does in `include/functions.inc.php`

in this function，There is no filter parameter `$_SERVER['HTTP_USER_AGENT']`



![2](https://user-images.githubusercontent.com/56486273/146197730-c50fbedc-3493-4578-88f8-d133ff3d0679.png)

then execute serialize and pwg_db_real_escape_string functions respectively



![3](https://user-images.githubusercontent.com/56486273/146197780-bb7b5034-9e65-4838-9dec-86f1d888e10b.png)

look at function(pwg_db_real_escape_string),it just prevent sql injection

```php
function pwg_db_real_escape_string($s)
{
  return mysql_real_escape_string($s);
}
```

then we register a user`yyds\yyds`


![4](https://user-images.githubusercontent.com/56486273/146197857-7db7d57f-4fe7-4571-a2aa-f055acf0c318.png)


then we click `logout`


![5](https://user-images.githubusercontent.com/56486273/146197874-1fb0bf17-1a84-41d4-ae11-0b1e1442f860.png)



then we just post like this，It is best to send more packages


![6](https://user-images.githubusercontent.com/56486273/146197891-df638a27-76c9-472f-97e3-bee9661abdd0.png)


```cmd
url:http://test.y4tacker.top/identification.php
User-Agent："><script>alert(`Hacked By Y4tacker`)</script><"
POST:
username=yyds&password=yyds&redirect=%2F&login=submit
```

Next, after the system administrator has logged in，and visit `http://xxx/admin.php?page=user_activity`
![7](https://user-images.githubusercontent.com/56486273/146197909-92fd89ba-7136-49fc-a13d-e803f8ce8634.png)



and look it

![8](https://user-images.githubusercontent.com/56486273/146197926-a858933b-02cb-410f-b992-36d5dd119292.png)


--- end body ---
