SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.
An SQL injection has been discovered in the administration panel of Piwigo v2.9.5. The vulnerability allows remote attackers that are authenticated as administrator to inject SQL code into a query and display. This could result in full information disclosure.

The vulnerability was found in the 'delete' method in admin/group_list.php, because it does not validate and filter the '$group' parameter when it gets the parameters. And the vulnerability could query any data in the database and display it on the page.

In the figure, I obtained the encrypted password of the user table.
![2](https://user-images.githubusercontent.com/34082644/57190820-617b1080-6f51-11e9-9d69-df2a0d6cd5a9.png)
![3](https://user-images.githubusercontent.com/34082644/57190823-65a72e00-6f51-11e9-9645-9bc19a7a6337.png)

SQL injection in group_list.php
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : SQL injection in group_list.php
Issue date:

--- start body ---
An SQL injection has been discovered in the administration panel of Piwigo v2.9.5. The vulnerability allows remote attackers that are authenticated as administrator to inject SQL code into a query and display. This could result in full information disclosure.

The vulnerability was found in the 'delete' method in admin/group_list.php, because it does not validate and filter the '$group' parameter when it gets the parameters. And the vulnerability could query any data in the database and display it on the page.

In the figure, I obtained the encrypted password of the user table.
![2](https://user-images.githubusercontent.com/34082644/57190820-617b1080-6f51-11e9-9d69-df2a0d6cd5a9.png)
![3](https://user-images.githubusercontent.com/34082644/57190823-65a72e00-6f51-11e9-9645-9bc19a7a6337.png)

--- end body ---
