Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.
Before replicating this vulnerability, you need to first create a new album and access the "photos_add" function, and choose to create a new album
![image](https://user-images.githubusercontent.com/27283436/235838268-ab39be83-c3da-446c-bb35-714a9dfd6c7d.png)
//like this
![image](https://user-images.githubusercontent.com/27283436/235838338-e1fed0c2-e344-4feb-a4e3-d01f724848cb.png)


Then,accessing permalinks functionality
![image](https://user-images.githubusercontent.com/27283436/235837872-be02b38c-07e1-4f69-8441-181634101d86.png)

click this
![image](https://user-images.githubusercontent.com/27283436/235838443-43cae672-198d-4e8a-b7c3-a8733f877cbf.png)

Select the album you just created and use 'burp' to  intercept this request
![image](https://user-images.githubusercontent.com/27283436/235838758-ad3686a9-2173-4a60-b862-aa652e3a607a.png)

You can see this' cat_id 'parameter, which is where SQL injection exists
![image](https://user-images.githubusercontent.com/27283436/235838800-7c01adcd-44dc-4423-81c5-f03a6a9efa63.png)

We are trying to add a single quotation mark to trigger an error in MySQL
![image](https://user-images.githubusercontent.com/27283436/235839002-ebdfd005-b9b9-4fc7-9508-257d39643ff5.png)

We can also directly try using the sleep () function to trigger a delay
![image](https://user-images.githubusercontent.com/27283436/235839307-64cce621-3c8c-49ac-8ac1-92236683148c.png)

It is not difficult to find that there is an SQL injection here. Next, we will analyze this problem from the code level.
The vulnerability arises from '/admin/permalinks.php'
//Start Here
![image](https://user-images.githubusercontent.com/27283436/235840323-b04c4561-5000-458d-a632-81c2ff4c24c7.png)

In our data package, we passed in the "set_permalink"  and “cat_ Id"parameter, and "cat_id"is greater than 0, so we can enter this if branch
![image](https://user-images.githubusercontent.com/27283436/235841193-cfa23f7e-6f2f-4e56-a45e-45ffb91e7ce6.png)

Then, because we passed in the 'permalink' parameter, we actually entered the internal else branch
![image](https://user-images.githubusercontent.com/27283436/235841540-f7f3f886-d562-4317-9e7f-8ece506edbcf.png)

Then we try to analyze the set_cat_permalink() function.（In /admin/include/functions_permalinks.php）
![image](https://user-images.githubusercontent.com/27283436/235841825-42a15428-17d5-41ba-8f81-375575afe18b.png)

In the end, we can find this SQL statement, where '$cat_id' is passed directly into the SQL statement without any filtering.It is precisely this location that caused SQL injection
![image](https://user-images.githubusercontent.com/27283436/235842001-973b7eca-030c-4643-9aba-a52b9a960de5.png)

This vulnerability exists in version 13.6.0, and it is uncertain whether this issue exists in earlier versions




There is a SQL Injection in the "permalinks" function of piwigo
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : There is a SQL Injection in the "permalinks" function of piwigo
Issue date:

--- start body ---
Before replicating this vulnerability, you need to first create a new album and access the "photos_add" function, and choose to create a new album
![image](https://user-images.githubusercontent.com/27283436/235838268-ab39be83-c3da-446c-bb35-714a9dfd6c7d.png)
//like this
![image](https://user-images.githubusercontent.com/27283436/235838338-e1fed0c2-e344-4feb-a4e3-d01f724848cb.png)


Then,accessing permalinks functionality
![image](https://user-images.githubusercontent.com/27283436/235837872-be02b38c-07e1-4f69-8441-181634101d86.png)

click this
![image](https://user-images.githubusercontent.com/27283436/235838443-43cae672-198d-4e8a-b7c3-a8733f877cbf.png)

Select the album you just created and use 'burp' to  intercept this request
![image](https://user-images.githubusercontent.com/27283436/235838758-ad3686a9-2173-4a60-b862-aa652e3a607a.png)

You can see this' cat_id 'parameter, which is where SQL injection exists
![image](https://user-images.githubusercontent.com/27283436/235838800-7c01adcd-44dc-4423-81c5-f03a6a9efa63.png)

We are trying to add a single quotation mark to trigger an error in MySQL
![image](https://user-images.githubusercontent.com/27283436/235839002-ebdfd005-b9b9-4fc7-9508-257d39643ff5.png)

We can also directly try using the sleep () function to trigger a delay
![image](https://user-images.githubusercontent.com/27283436/235839307-64cce621-3c8c-49ac-8ac1-92236683148c.png)

It is not difficult to find that there is an SQL injection here. Next, we will analyze this problem from the code level.
The vulnerability arises from '/admin/permalinks.php'
//Start Here
![image](https://user-images.githubusercontent.com/27283436/235840323-b04c4561-5000-458d-a632-81c2ff4c24c7.png)

In our data package, we passed in the "set_permalink"  and “cat_ Id"parameter, and "cat_id"is greater than 0, so we can enter this if branch
![image](https://user-images.githubusercontent.com/27283436/235841193-cfa23f7e-6f2f-4e56-a45e-45ffb91e7ce6.png)

Then, because we passed in the 'permalink' parameter, we actually entered the internal else branch
![image](https://user-images.githubusercontent.com/27283436/235841540-f7f3f886-d562-4317-9e7f-8ece506edbcf.png)

Then we try to analyze the set_cat_permalink() function.（In /admin/include/functions_permalinks.php）
![image](https://user-images.githubusercontent.com/27283436/235841825-42a15428-17d5-41ba-8f81-375575afe18b.png)

In the end, we can find this SQL statement, where '$cat_id' is passed directly into the SQL statement without any filtering.It is precisely this location that caused SQL injection
![image](https://user-images.githubusercontent.com/27283436/235842001-973b7eca-030c-4643-9aba-a52b9a960de5.png)

This vulnerability exists in version 13.6.0, and it is uncertain whether this issue exists in earlier versions




--- end body ---
