SQL Injection vulnerability in admin/userperm.php in piwigo v2.9.5, via the catfalse parameter to admin.php?page=user_perm.