Executive brief
Admidio is a web-based membership management system. Versions before 5.0.12 contain an unauthenticated blind SQL injection vulnerability in the user list filtering feature, allowing attackers to extract sensitive data including password hashes and user credentials from the database without logging in. An attacker can bypass authentication by providing a dummy role identifier and inject malicious SQL code through the filter parameters.
Technical details
This is a blind SQL injection vulnerability (CWE-89) in modules/groups-roles/lists_show.php and src/Roles/Entity/ListConfiguration.php. The root cause is insufficient input validation: the relation_type_list GET parameter undergoes only HTML encoding (strip_tags and htmlspecialchars) but is directly concatenated into an SQL IN clause without prepared statement binding or UUID validation. An unauthenticated attacker can bypass permission checks by providing a valid-format but non-existent UUID in the role_list parameter, causing the permission validation loop to be skipped. The attacker then injects SQL through relation_type_list (e.g., using backslash escaping or comment syntax) to extract database contents. Since results are not displayed directly, the attacker constructs queries that trigger cardinality errors, creating a boolean oracle to extract data. The file lacks login enforcement, allowing pre-authentication access. Fixed in version 5.0.12.
Affected products
- Admidio Admidio < 5.0.12
Timeline
- 2026-08-16: disclosed
- 2026-08-30: patched: Version 5.0.12 released