Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function.
Access the 'Users' function and use the filter function 
![image](https://github.com/Piwigo/Piwigo/assets/67749472/e2d503b5-096f-4528-97f1-8b9b015cc222)

Observe the request on Burp Suite 
![image](https://github.com/Piwigo/Piwigo/assets/67749472/7e4280b1-3b93-4c36-9bd3-a03aa1645555)

Manipulate the 'order' or 'exclude[]' parameter by adding a single quote, and an error in MYSQL shows up, proving the existence of SQL injection
![image](https://github.com/Piwigo/Piwigo/assets/67749472/ee524c6f-96c5-4c0f-adf2-746a5d58a869)

We can try to retrieve all the databases name with the error-based payload `id AND (SELECT 2690 FROM(SELECT COUNT(*),CONCAT(0x716b707671,(SELECT MID((IFNULL(CAST(schema_name AS NCHAR),0x20)),1,51) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),0x7162787071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)` , just increasing the LIMIT value to enumerate all the databases name
![image](https://github.com/Piwigo/Piwigo/assets/67749472/42af1d2b-c9aa-4d96-ad3a-511eecd03349)

Analyze the vulnerability from the source code, locate the ws_users_getList() function (/piwigo/include/ws_functions/pwg.users.php), notice that 'order' was concat directly after the 'ORDER BY' clause without any kind of input sanitization. The same case happens for 
the 'exclude[]' parameter
![image](https://github.com/Piwigo/Piwigo/assets/67749472/4339a86f-c04f-4599-a87d-872bd6fea415)

This vulnerability affects the latest version up to 13.7.0, and it is uncertain if other versions will be affected.
SQL Injection in the "Users" function of piwigo
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : SQL Injection in the "Users" function of piwigo
Issue date:

--- start body ---
Access the 'Users' function and use the filter function 
![image](https://github.com/Piwigo/Piwigo/assets/67749472/e2d503b5-096f-4528-97f1-8b9b015cc222)

Observe the request on Burp Suite 
![image](https://github.com/Piwigo/Piwigo/assets/67749472/7e4280b1-3b93-4c36-9bd3-a03aa1645555)

Manipulate the 'order' or 'exclude[]' parameter by adding a single quote, and an error in MYSQL shows up, proving the existence of SQL injection
![image](https://github.com/Piwigo/Piwigo/assets/67749472/ee524c6f-96c5-4c0f-adf2-746a5d58a869)

We can try to retrieve all the databases name with the error-based payload `id AND (SELECT 2690 FROM(SELECT COUNT(*),CONCAT(0x716b707671,(SELECT MID((IFNULL(CAST(schema_name AS NCHAR),0x20)),1,51) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),0x7162787071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)` , just increasing the LIMIT value to enumerate all the databases name
![image](https://github.com/Piwigo/Piwigo/assets/67749472/42af1d2b-c9aa-4d96-ad3a-511eecd03349)

Analyze the vulnerability from the source code, locate the ws_users_getList() function (/piwigo/include/ws_functions/pwg.users.php), notice that 'order' was concat directly after the 'ORDER BY' clause without any kind of input sanitization. The same case happens for 
the 'exclude[]' parameter
![image](https://github.com/Piwigo/Piwigo/assets/67749472/4339a86f-c04f-4599-a87d-872bd6fea415)

This vulnerability affects the latest version up to 13.7.0, and it is uncertain if other versions will be affected.
--- end body ---
