Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.
Without entering too much into details there is a possible SQL injection in file `admin/user_list_backend.php`. This file has no reason to be still in Piwigo since version 12 and the new user manager (which relies on `ws.php` as backend). This file must simply be removed.
[13.x] SQL injection on user_list_backend.php
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : [13.x] SQL injection on user_list_backend.php
Issue date:

--- start body ---
Without entering too much into details there is a possible SQL injection in file `admin/user_list_backend.php`. This file has no reason to be still in Piwigo since version 12 and the new user manager (which relies on `ws.php` as backend). This file must simply be removed.
--- end body ---
