Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.
The following is the detail about this vulnerability I found in Piwigo 11.5.0:
First, visit URL/admin.php and login, then click Album-Move. On this page, click ORDER on the right side.

![1](https://user-images.githubusercontent.com/67731575/131251900-dd25e4e2-473c-41d0-b574-e037a0fd1711.png)
Then we can see:

![2](https://user-images.githubusercontent.com/67731575/131251975-d4128249-3e35-40f0-a79d-79ca256f4b53.png)
Select default, use Burpsuite during clicking APPLY.

![3](https://user-images.githubusercontent.com/67731575/131252161-420a5a52-23dd-4dc4-934d-dd4bd58db1aa.png)
Then in sqlmap:

python sqlmap.py -r post.txt -o --dbms=MySQL
![6](https://user-images.githubusercontent.com/67731575/131252197-b8d80c1a-16ff-4769-a668-0880816bc0f7.png)

See admin\cat_move.php:

![8](https://user-images.githubusercontent.com/67731575/131252300-241ddce4-1931-493b-8ecb-aec14207e6a4.png)

Here there seems to be no confirmation of the legitimacy of the parameter $_POST[id]. And other parameters are legal so query is done.

Here is the manual injection test:

(Load successfully after sleeping 5 seconds)
![4](https://user-images.githubusercontent.com/67731575/131252627-a980c52d-fd13-4bb3-8009-296b34c005e2.png)
 
Thanks for reading!

[11.5.0]SQL Injection Vulnerability
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : [11.5.0]SQL Injection Vulnerability
Issue date:

--- start body ---
The following is the detail about this vulnerability I found in Piwigo 11.5.0:
First, visit URL/admin.php and login, then click Album-Move. On this page, click ORDER on the right side.

![1](https://user-images.githubusercontent.com/67731575/131251900-dd25e4e2-473c-41d0-b574-e037a0fd1711.png)
Then we can see:

![2](https://user-images.githubusercontent.com/67731575/131251975-d4128249-3e35-40f0-a79d-79ca256f4b53.png)
Select default, use Burpsuite during clicking APPLY.

![3](https://user-images.githubusercontent.com/67731575/131252161-420a5a52-23dd-4dc4-934d-dd4bd58db1aa.png)
Then in sqlmap:

python sqlmap.py -r post.txt -o --dbms=MySQL
![6](https://user-images.githubusercontent.com/67731575/131252197-b8d80c1a-16ff-4769-a668-0880816bc0f7.png)

See admin\cat_move.php:

![8](https://user-images.githubusercontent.com/67731575/131252300-241ddce4-1931-493b-8ecb-aec14207e6a4.png)

Here there seems to be no confirmation of the legitimacy of the parameter $_POST[id]. And other parameters are legal so query is done.

Here is the manual injection test:

(Load successfully after sleeping 5 seconds)
![4](https://user-images.githubusercontent.com/67731575/131252627-a980c52d-fd13-4bb3-8009-296b34c005e2.png)
 
Thanks for reading!

--- end body ---

The issue describes a SQL Injection vulnerability in Piwigo 11.5.0, specifically in the admin interface where user input is not properly validated before being used in SQL queries. This allows an attacker to manipulate the SQL query by injecting malicious SQL code through the $_POST[id] parameter, potentially leading to unauthorized access to the database or data leakage.