Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component.
### **Summary**
A reflected cross-site scripting (XSS) vulnerability has been discovered in the "ato_lang" parameter.  This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by webmaster or administrators when they visit the URL with the payload.

Since The lang parameter exists on every page, which results in a malicious lang value (session-level persistence XSS) attached to any page that administrator visits before the session ends.

### **Details**
The vulnerability is caused by the insecure injection of the "ato_lang" value from the URL into the HTML page.    An attacker can exploit this vulnerability by crafting a malicious URL that contains a specially crafted "ato_lang" value.    When a victim who is logged in as an webmaster or administrator visits this URL, the malicious code will be injected into the HTML page and executed.
Attackers can construct malicious lang values in PHP files that accept ato_lang in lang parameters at any time.   Basically, all pages presented to administrator will have (ato_)lang values.   This means that the payload that occurs is not fixed.

### **Vulnerability recurrence requirements**
The webmaster opens the Admin Tools plug-in
The webmaster or administrators opens the link for the malicious ato_lang value

### **Proof of Concept (POC)**
Open the "Admin Tools" plugin
![image](https://github.com/Hebing123/cve/assets/66168888/22f033b4-1e29-4608-a776-85c19fcec681)

Access a PHP file that can accept the value of the lang parameter.
http://192.168.160.147/index.php?ato_lang=zh_TW%3C/script%3E%3Cscript%3Ealert(9017)%3C/script%3E&mobile=false&
![image](https://github.com/Hebing123/cve/assets/66168888/6c4805a0-5996-4337-8f79-3c6f7f66f292)

Access other web pages, such as the profile.php.
![image](https://github.com/Hebing123/cve/assets/66168888/b73832c3-6425-454f-b34f-d0abd399d097)

Giving a malicious value of $ato.MULTIVIEW.lang can lead to reflective XSS vulnerabilities.
The lang parameter exists on every page, which results in a malicious lang value (session-level persistence XSS) attached to any page that a webmaster or administrator visits before the session ends.

**Because the security team did not respond within 72 hours, I made the report public.**
piwigo v14.0.0 has a reflected XSS vulnerability
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : piwigo v14.0.0 has a reflected XSS vulnerability
Issue date:

--- start body ---
### **Summary**
A reflected cross-site scripting (XSS) vulnerability has been discovered in the "ato_lang" parameter.  This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by webmaster or administrators when they visit the URL with the payload.

Since The lang parameter exists on every page, which results in a malicious lang value (session-level persistence XSS) attached to any page that administrator visits before the session ends.

### **Details**
The vulnerability is caused by the insecure injection of the "ato_lang" value from the URL into the HTML page.    An attacker can exploit this vulnerability by crafting a malicious URL that contains a specially crafted "ato_lang" value.    When a victim who is logged in as an webmaster or administrator visits this URL, the malicious code will be injected into the HTML page and executed.
Attackers can construct malicious lang values in PHP files that accept ato_lang in lang parameters at any time.   Basically, all pages presented to administrator will have (ato_)lang values.   This means that the payload that occurs is not fixed.

### **Vulnerability recurrence requirements**
The webmaster opens the Admin Tools plug-in
The webmaster or administrators opens the link for the malicious ato_lang value

### **Proof of Concept (POC)**
Open the "Admin Tools" plugin
![image](https://github.com/Hebing123/cve/assets/66168888/22f033b4-1e29-4608-a776-85c19fcec681)

Access a PHP file that can accept the value of the lang parameter.
http://192.168.160.147/index.php?ato_lang=zh_TW%3C/script%3E%3Cscript%3Ealert(9017)%3C/script%3E&mobile=false&
![image](https://github.com/Hebing123/cve/assets/66168888/6c4805a0-5996-4337-8f79-3c6f7f66f292)

Access other web pages, such as the profile.php.
![image](https://github.com/Hebing123/cve/assets/66168888/b73832c3-6425-454f-b34f-d0abd399d097)

Giving a malicious value of $ato.MULTIVIEW.lang can lead to reflective XSS vulnerabilities.
The lang parameter exists on every page, which results in a malicious lang value (session-level persistence XSS) attached to any page that a webmaster or administrator visits before the session ends.

**Because the security team did not respond within 72 hours, I made the report public.**
--- end body ---
