Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
As reported by Harry Goodman from NCC Group:

> The ‘order[0][dir]’ parameter in admin/user_list_backend.php is vulnerable to SQL injection
>
> I believe this is because of the following pieces of code:

```
68   if ( $_REQUEST['columns'][$col]["searchable"] == "true" )
69   {
70     $sOrder .= $aColumns[ $col ].' '.$_REQUEST["order"][0]["dir"].', ';
71   }
```

> I would suggest either using the check_inputs function that your application seems to rely on, or depending on how much functionality is needed, just do a check to ensure the parameter is either ASC or DESC.
>
> CVE-2021-32615
[11.x, user manager] SQL injection
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : [11.x, user manager] SQL injection
Issue date:

--- start body ---
As reported by Harry Goodman from NCC Group:

> The ‘order[0][dir]’ parameter in admin/user_list_backend.php is vulnerable to SQL injection
>
> I believe this is because of the following pieces of code:

```
68   if ( $_REQUEST['columns'][$col]["searchable"] == "true" )
69   {
70     $sOrder .= $aColumns[ $col ].' '.$_REQUEST["order"][0]["dir"].', ';
71   }
```

> I would suggest either using the check_inputs function that your application seems to rely on, or depending on how much functionality is needed, just do a check to ensure the parameter is either ASC or DESC.
>
> CVE-2021-32615
--- end body ---

The 'order[0][dir]' parameter in the Piwigo application is vulnerable to SQL injection due to insufficient validation of user input. An attacker can manipulate this parameter to execute arbitrary SQL commands, potentially compromising the database. The issue is highlighted in the code snippet where the direction of ordering is directly appended to the SQL query without proper sanitization or validation. It is recommended to implement input validation to ensure that the parameter only accepts expected values (e.g., 'ASC' or 'DESC').