CVE-2024-46333 in Piwigo
Summary
by MITRE • 09/27/2024
An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album function.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/28/2025
The vulnerability identified as CVE-2024-46333 represents a critical authenticated cross-site scripting flaw within Piwigo version 14.5.0, a popular open-source photo gallery management system. This weakness specifically manifests within the Add Album functionality where the Album Name parameter fails to properly sanitize user input, creating an avenue for malicious actors to inject arbitrary web scripts or HTML code. The vulnerability requires authentication to exploit, meaning that an attacker must first gain valid credentials to the system before being able to leverage this XSS vector, though this does not diminish its potential impact on user sessions and data integrity.
The technical nature of this vulnerability aligns with CWE-79, which defines Cross-Site Scripting as a condition where an application incorporates untrusted data into web pages without proper validation or escaping mechanisms. In this instance, the flaw exists in the input processing of the Album Name field within the administrative album creation interface. When an authenticated user submits a crafted payload containing malicious script code into the album name field, the application fails to adequately escape or filter the input before rendering it in subsequent web responses. This allows the injected script to execute within the context of other users' browsers who view the affected album, potentially compromising their sessions and enabling further attacks.
The operational impact of this vulnerability extends beyond simple script execution, as it can facilitate session hijacking, credential theft, and the redirection of users to malicious websites. An attacker with valid credentials could craft a malicious album name containing JavaScript that steals cookies, redirects users to phishing sites, or even executes more sophisticated attacks such as CSRF (Cross-Site Request Forgery) attacks against other system functions. The authenticated nature of the vulnerability means that the attack surface is limited to users with legitimate access, but this also implies that compromised accounts could lead to significant damage within the gallery's user base and potentially to the underlying system infrastructure.
Mitigation strategies for CVE-2024-46333 should prioritize immediate patching of the affected Piwigo version to the latest stable release that addresses this specific XSS vulnerability. Organizations should implement proper input validation and output encoding mechanisms, ensuring that all user-supplied data is properly sanitized before being processed or displayed. The implementation of Content Security Policy (CSP) headers can provide additional protection against XSS attacks by restricting the sources from which scripts can be executed. Security teams should also conduct regular vulnerability assessments and penetration testing to identify similar input validation flaws across the entire application stack. This vulnerability demonstrates the critical importance of proper input sanitization in web applications and aligns with ATT&CK technique T1059.007 for Scripting, where adversaries leverage XSS vulnerabilities to execute malicious scripts in the context of legitimate user sessions.