Piwigo Reflected XSS vulnerability

CVE-2023-44393

What is CVE-2023-44393?

Piwigo, an open-source photo gallery application, is susceptible to a reflected cross-site scripting (XSS) vulnerability prior to version 14.0.0beta4. The issue arises from the improper handling of the 'plugin_id' parameter in the URL on the /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here] page, allowing malicious actors to inject harmful HTML and JavaScript code. When an administrator accesses a crafted URL containing the exploit, the injected script is executed within the admin interface, potentially compromising the security of the application and its data. This vulnerability impacts only logged-in administrators, emphasizing the need for careful URL handling and timely updates to mitigate risks associated with such exploits.

References