Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.
The following is the detail about this vulnerability I found in Piwigo 11.5.0:
First, visit URL/admin.php and login, then click Album-Move. On this page, click ORDER on the right side.

![1](https://user-images.githubusercontent.com/67731575/131251900-dd25e4e2-473c-41d0-b574-e037a0fd1711.png)
Then we can see:

![2](https://user-images.githubusercontent.com/67731575/131251975-d4128249-3e35-40f0-a79d-79ca256f4b53.png)
Select default, use Burpsuite during clicking APPLY.

![3](https://user-images.githubusercontent.com/67731575/131252161-420a5a52-23dd-4dc4-934d-dd4bd58db1aa.png)
Then in sqlmap:

python sqlmap.py -r post.txt -o --dbms=MySQL
![6](https://user-images.githubusercontent.com/67731575/131252197-b8d80c1a-16ff-4769-a668-0880816bc0f7.png)

See admin\cat_move.php:

![8](https://user-images.githubusercontent.com/67731575/131252300-241ddce4-1931-493b-8ecb-aec14207e6a4.png)

Here there seems to be no confirmation of the legitimacy of the parameter $_POST[id]. And other parameters are legal so query is done.

Here is the manual injection test:

(Load successfully after sleeping 5 seconds)
![4](https://user-images.githubusercontent.com/67731575/131252627-a980c52d-fd13-4bb3-8009-296b34c005e2.png)
 
Thanks for reading!

[11.5.0]SQL Injection Vulnerability
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : [11.5.0]SQL Injection Vulnerability
Issue date:

--- start body ---
The following is the detail about this vulnerability I found in Piwigo 11.5.0:
First, visit URL/admin.php and login, then click Album-Move. On this page, click ORDER on the right side.

![1](https://user-images.githubusercontent.com/67731575/131251900-dd25e4e2-473c-41d0-b574-e037a0fd1711.png)
Then we can see:

![2](https://user-images.githubusercontent.com/67731575/131251975-d4128249-3e35-40f0-a79d-79ca256f4b53.png)
Select default, use Burpsuite during clicking APPLY.

![3](https://user-images.githubusercontent.com/67731575/131252161-420a5a52-23dd-4dc4-934d-dd4bd58db1aa.png)
Then in sqlmap:

python sqlmap.py -r post.txt -o --dbms=MySQL
![6](https://user-images.githubusercontent.com/67731575/131252197-b8d80c1a-16ff-4769-a668-0880816bc0f7.png)

See admin\cat_move.php:

![8](https://user-images.githubusercontent.com/67731575/131252300-241ddce4-1931-493b-8ecb-aec14207e6a4.png)

Here there seems to be no confirmation of the legitimacy of the parameter $_POST[id]. And other parameters are legal so query is done.

Here is the manual injection test:

(Load successfully after sleeping 5 seconds)
![4](https://user-images.githubusercontent.com/67731575/131252627-a980c52d-fd13-4bb3-8009-296b34c005e2.png)
 
Thanks for reading!

--- end body ---
