Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
Accessing the 'profile' page
![image](https://user-images.githubusercontent.com/27283436/236197441-196a43d0-f0ba-43ac-9448-f029bec196c7.png)

Add the 'user_id' parameter with single quotes
![image](https://user-images.githubusercontent.com/27283436/236197644-ae97d84c-4296-4721-aa16-b21665c9500e.png)

Discovering an error in MySQL can actually prove the existence of SQL injection, but we can still try using the sleep() function for testing
![image](https://user-images.githubusercontent.com/27283436/236197884-f0ce2eba-c8f8-4149-b00d-d749df754b5a.png)
![image](https://user-images.githubusercontent.com/27283436/236197944-08f57be8-55a0-4f3b-b0f0-5c9a817a38a5.png)

//Try to analyze how this vulnerability was generated from a code level perspective.
![image](https://user-images.githubusercontent.com/27283436/236198160-a60843de-6d4d-4387-8a11-d1859ddcdb4d.png)

First find '/admin/profile.php'
![image](https://user-images.githubusercontent.com/27283436/236198316-b51f7340-abce-4fa1-8140-237b263485dd.png)

Track build_user() function    (in the /Piwigo/include/functions_user.inc.php)
![image](https://user-images.githubusercontent.com/27283436/236198585-aef18e94-9fa6-49fc-ba1f-f6c4d66cec17.png)

The '$user_id'  enters the getuserdata() function, so continue tracking getuserdata()
![image](https://user-images.githubusercontent.com/27283436/236200448-87f3c1ab-eeb8-4fdb-8fb6-2595fa2a8b18.png)


Finally, the '$user_id' variable will enter this string of SQL statements, which clearly does not filter the incoming parameter values, resulting in SQL injection
![image](https://user-images.githubusercontent.com/27283436/236200578-779570be-22ca-4459-8c2f-66fbbc2369ad.png)

This vulnerability affects the latest version up to 13.6.0, and it is uncertain whether other versions will be affected.
There is a SQL Injection in the "profile" function of piwigo
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : There is a SQL Injection in the "profile" function of piwigo
Issue date:

--- start body ---
Accessing the 'profile' page
![image](https://user-images.githubusercontent.com/27283436/236197441-196a43d0-f0ba-43ac-9448-f029bec196c7.png)

Add the 'user_id' parameter with single quotes
![image](https://user-images.githubusercontent.com/27283436/236197644-ae97d84c-4296-4721-aa16-b21665c9500e.png)

Discovering an error in MySQL can actually prove the existence of SQL injection, but we can still try using the sleep() function for testing
![image](https://user-images.githubusercontent.com/27283436/236197884-f0ce2eba-c8f8-4149-b00d-d749df754b5a.png)
![image](https://user-images.githubusercontent.com/27283436/236197944-08f57be8-55a0-4f3b-b0f0-5c9a817a38a5.png)

//Try to analyze how this vulnerability was generated from a code level perspective.
![image](https://user-images.githubusercontent.com/27283436/236198160-a60843de-6d4d-4387-8a11-d1859ddcdb4d.png)

First find '/admin/profile.php'
![image](https://user-images.githubusercontent.com/27283436/236198316-b51f7340-abce-4fa1-8140-237b263485dd.png)

Track build_user() function    (in the /Piwigo/include/functions_user.inc.php)
![image](https://user-images.githubusercontent.com/27283436/236198585-aef18e94-9fa6-49fc-ba1f-f6c4d66cec17.png)

The '$user_id'  enters the getuserdata() function, so continue tracking getuserdata()
![image](https://user-images.githubusercontent.com/27283436/236200448-87f3c1ab-eeb8-4fdb-8fb6-2595fa2a8b18.png)


Finally, the '$user_id' variable will enter this string of SQL statements, which clearly does not filter the incoming parameter values, resulting in SQL injection
![image](https://user-images.githubusercontent.com/27283436/236200578-779570be-22ca-4459-8c2f-66fbbc2369ad.png)

This vulnerability affects the latest version up to 13.6.0, and it is uncertain whether other versions will be affected.
--- end body ---
