[11.x, user manager] SQL injection #1230

New Issue

2026-10-05T00:36:56+02:00

adam commented

2026-10-05 00:36:56 +02:00

As reported by Harry Goodman from NCC Group:

The ‘order[0][dir]’ parameter in admin/user_list_backend.php is vulnerable to SQL injection

I believe this is because of the following pieces of code:

68   if ( $_REQUEST['columns'][$col]["searchable"] == "true" )
69   {
70     $sOrder .= $aColumns[ $col ].' '.$_REQUEST["order"][0]["dir"].', ';
71   }

I would suggest either using the check_inputs function that your application seems to rely on, or depending on how much functionality is needed, just do a check to ensure the parameter is either ASC or DESC.

CVE-2021-32615

As reported by Harry Goodman from NCC Group: > The ‘order[0][dir]’ parameter in admin/user_list_backend.php is vulnerable to SQL injection > > I believe this is because of the following pieces of code: ``` 68 if ( $_REQUEST['columns'][$col]["searchable"] == "true" ) 69 { 70 $sOrder .= $aColumns[ $col ].' '.$_REQUEST["order"][0]["dir"].', '; 71 } ``` > I would suggest either using the check_inputs function that your application seems to rely on, or depending on how much functionality is needed, just do a check to ensure the parameter is either ASC or DESC. > > CVE-2021-32615

adam closed this issue

2026-10-05 00:36:57 +02:00

Sign in to join this conversation.

master

issue-2560-people

translation

16.x

feat/embedding-based-contextual-tagging

issue-2576-search-include-ai-in-search-results

feat/search-ocr-ai

issue-2391-update-menu-design

15.x

detect-container

issue-2386-update-filters-users-activity

issue-2362-add-filters-options-in-admin

issue-2367-imagemagick7

issue-2225-quicksearch-help

14.x

issue-2164-BatchManagerUnitMode-Redesign

13.x

12.x

issue-1657-SVG_Support

issue-1703-historySearchMethod

11.x

2.10

2.9

2.8

2.7

2.5

2.6

2.4

2.3

2.2

2.1

2.0

1.7

1.3

1.6

1.5

1.4

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/Piwigo#1230