Description
Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.php and this same function is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=user_list.
Remediation
References
Related Vulnerabilities
WordPress Plugin Slider Hero with Animation, Video Background Cross-Site Request Forgery (8.2.0)
WordPress 3.7.x Multiple Vulnerabilities (3.7 - 3.7.33)
WordPress Plugin WP Page Builder Cross-Site Scripting (1.2.6)
WordPress Plugin Child Themes Helper Multiple Vulnerabilities (2.0)
WordPress Plugin Availability Calendar Cross-Site Scripting (1.2.1)