SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote adminsitrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php.