Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
As reported by Harry Goodman from NCC Group:

> The ‘order[0][dir]’ parameter in admin/user_list_backend.php is vulnerable to SQL injection
>
> I believe this is because of the following pieces of code:

```
68   if ( $_REQUEST['columns'][$col]["searchable"] == "true" )
69   {
70     $sOrder .= $aColumns[ $col ].' '.$_REQUEST["order"][0]["dir"].', ';
71   }
```

> I would suggest either using the check_inputs function that your application seems to rely on, or depending on how much functionality is needed, just do a check to ensure the parameter is either ASC or DESC.
>
> CVE-2021-32615
[11.x, user manager] SQL injection
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : [11.x, user manager] SQL injection
Issue date:

--- start body ---
As reported by Harry Goodman from NCC Group:

> The ‘order[0][dir]’ parameter in admin/user_list_backend.php is vulnerable to SQL injection
>
> I believe this is because of the following pieces of code:

```
68   if ( $_REQUEST['columns'][$col]["searchable"] == "true" )
69   {
70     $sOrder .= $aColumns[ $col ].' '.$_REQUEST["order"][0]["dir"].', ';
71   }
```

> I would suggest either using the check_inputs function that your application seems to rely on, or depending on how much functionality is needed, just do a check to ensure the parameter is either ASC or DESC.
>
> CVE-2021-32615
--- end body ---
