Description

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in role_list and inject SQL through relation_type_list to extract database contents including password hashes and user credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-30T15:16:46.310Z",
  "pubdate": "2026-08-30T15:16:46.310Z",
  "executiveSummary": "Admidio versions prior to 5.0.12 are susceptible to a critical blind SQL injection vulnerability located within the lists_show.php file.\nThe vulnerability originates from improper neutralization of user-supplied input within the relation_type_list parameter.\nThis security flaw allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.\nBy manipulating the database query structure, an attacker can extract sensitive information, including password hashes, user credentials, and internal configuration data.\nThe attack vector is particularly dangerous as it permits authentication bypass via the injection of a dummy UUID into the role_list parameter, effectively circumventing standard security controls.\nThis vulnerability poses a severe risk to data confidentiality and integrity, potentially leading to full compromise of the application and its underlying data store.\nThe flaw is externally exploitable over the network, requiring no prior authentication or administrative privileges to execute.",
  "technicalDetails": "The vulnerability resides in the application's handling of HTTP GET/POST parameters within the lists_show.php script. The specific target component fails to properly validate and sanitize the input provided to the relation_type_list parameter before incorporating it into an active SQL query.\nThe attack flow begins with the attacker supplying a malformed or arbitrary UUID string to the role_list parameter. This bypasses the application's intended authentication logic, tricking the system into processing the request as if it originated from an authorized context.\nOnce the authentication check is bypassed, the attacker leverages the relation_type_list parameter to inject malicious SQL syntax. Because the application processes this input without using prepared statements or parameterized queries, the injected SQL code is concatenated directly into the database command.\nThe vulnerability is characterized as a 'blind' SQL injection, meaning the attacker may not receive direct output of query results in the HTTP response. Instead, they must rely on inferential techniques—such as time-based or boolean-based blind injection—to determine if their injected SQL queries are executing successfully.\nBy iteratively testing boolean conditions or measuring server response times during query execution, the attacker can systematically reconstruct the database structure and extract contents bit-by-bit. This allows for the exfiltration of sensitive records, including administrative credentials and user password hashes stored within the Admidio database.\nThe scope of impact includes unauthorized access to all tables accessible by the database user configured for the Admidio instance. Given the nature of the application, this typically includes user rosters, group memberships, and system configuration data. The ability to bypass authentication renders traditional perimeter defenses ineffective against this specific attack vector.\nThe flaw affects all Admidio deployments prior to version 5.0.12. The underlying issue is a failure in the application's input handling layer, which allows malicious SQL commands to influence the backend query logic during the request lifecycle in the lists_show.php component."
}