Unauthenticated Blind SQL Injection in Admidio

Admidio versions prior to 5.0.12 contain a blind SQL injection vulnerability in the relation_type_list parameter of the lists_show.php file. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries against the underlying database. By supplying a dummy UUID in the role_list parameter, an attacker can bypass standard authentication checks and manipulate the relation_type_list parameter to perform time-based or boolean-based SQL injection. This vector provides a mechanism for unauthorized actors to exfiltrate sensitive data, including user credentials and password hashes stored in the application database.

Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to extract the entire contents of the Admidio database. This poses a significant risk to the confidentiality of organizational data, as the exposure of user password hashes and credentials can facilitate further unauthorized access or account takeover across the environment.

Recommendation

• Upgrade Admidio to version 5.0.12 or later immediately to patch the vulnerable lists_show.php file.
• Review web server access logs for anomalous requests containing SQL keywords or character sequences (e.g., SLEEP, UNION, SELECT) targeting the lists_show.php endpoint.
• Implement a Web Application Firewall (WAF) rule to block or sanitize input containing common SQL injection payloads targeted at the relation_type_list parameter.