SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.
An SQL injection has been discovered in the administration panel of Piwigo v2.9.5. The vulnerability allows remote attackers that are authenticated as administrator to inject SQL code into a query and display. This could result in full information disclosure.

The vulnerability was found in the 'delete' method in admin/group_list.php, because it does not validate and filter the '$group' parameter when it gets the parameters. And the vulnerability could query any data in the database and display it on the page.

In the figure, I obtained the encrypted password of the user table.
![2](https://user-images.githubusercontent.com/34082644/57190820-617b1080-6f51-11e9-9d69-df2a0d6cd5a9.png)
![3](https://user-images.githubusercontent.com/34082644/57190823-65a72e00-6f51-11e9-9645-9bc19a7a6337.png)

SQL injection in group_list.php
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : SQL injection in group_list.php
Issue date:

--- start body ---
An SQL injection has been discovered in the administration panel of Piwigo v2.9.5. The vulnerability allows remote attackers that are authenticated as administrator to inject SQL code into a query and display. This could result in full information disclosure.

The vulnerability was found in the 'delete' method in admin/group_list.php, because it does not validate and filter the '$group' parameter when it gets the parameters. And the vulnerability could query any data in the database and display it on the page.

In the figure, I obtained the encrypted password of the user table.
![2](https://user-images.githubusercontent.com/34082644/57190820-617b1080-6f51-11e9-9d69-df2a0d6cd5a9.png)
![3](https://user-images.githubusercontent.com/34082644/57190823-65a72e00-6f51-11e9-9645-9bc19a7a6337.png)

--- end body ---

An SQL injection vulnerability in the administration panel of Piwigo v2.9.5 allows authenticated administrators to inject SQL code into queries via the '$group' parameter in the 'delete' method of admin/group_list.php. This could lead to full information disclosure, including sensitive data such as user passwords.