CVE-2026-82655 in Admidio
Summary
by MITRE • 08/30/2026
Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in role_list and inject SQL through relation_type_list to extract database contents including password hashes and user credentials.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/30/2026
The identified vulnerability represents a critical security flaw within the Admidio content management system, specifically affecting versions prior to 5.0.12. This issue is classified as an unauthenticated blind SQL injection located in the lists_show.php script through the relation_type_list parameter. The severity of this vulnerability stems from its ability to allow remote attackers who have not yet authenticated into the application to execute arbitrary Structured Query Language commands against the underlying database backend. Unlike standard injection flaws that might return immediate error messages or visible data, a blind SQL injection requires the attacker to infer information based on the application's response behavior, such as time delays or boolean-based differences in page content, making detection by automated scanners more difficult while still allowing for systematic extraction of sensitive data.
The operational mechanism of this exploit relies on a specific authentication bypass technique combined with parameter manipulation. Attackers can circumvent initial access controls by supplying a dummy Universally Unique Identifier (UUID) within the role_list parameter, which tricks the application into processing subsequent requests without verifying proper user permissions or session validity. Once this bypass is achieved, the attacker targets the relation_type_list parameter to inject malicious SQL payloads. Because the input validation and sanitization processes fail to properly escape special characters or validate data types before constructing database queries, the injected code becomes part of the executed query string. This allows for complex operations including boolean-based inference and time-based extraction techniques that can systematically retrieve information from the database schema without triggering immediate application errors that might alert administrators.
The impact of this vulnerability is severe due to the potential for complete data compromise within the Admidio environment. Since SQL injection provides direct access to the database layer, attackers can extract sensitive organizational data including user credentials and password hashes. The exposure of password hashes enables offline cracking attacks, potentially leading to full account takeover if weak hashing algorithms or poor password policies are in place. Furthermore, depending on the privileges granted to the database service account used by Admidio, an attacker could escalate their access to perform destructive actions such as modifying configuration files, altering user roles and permissions, or even achieving remote code execution through specific database features like xp_cmdshell in Microsoft SQL Server or LOAD_FILE functions in MySQL. This compromises not only confidentiality but also integrity and availability of the system's data assets.
From a classification perspective, this vulnerability aligns with Common Weakness Enumeration (CWE) ID 89, which covers Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. Additionally, the exploitation technique maps to MITRE ATT&CK framework techniques such as T1059.004 for Command and Scripting Interpreter: SQL Commands, and potentially T1136.001 for Create Account: Local Account if new administrative accounts are created via injection. The authentication bypass aspect also relates to CWE 287, Improper Authentication, although the primary vector remains the injection flaw itself. Understanding these mappings helps in aligning remediation efforts with broader security frameworks and threat intelligence models used by enterprise defense teams.
To mitigate this vulnerability, organizations running Admidio must immediately upgrade to version 5.0.12 or later where the issue has been resolved through improved input validation and parameterized query implementations. Until an upgrade is feasible, temporary mitigations should include implementing a Web Application Firewall (WAF) with rules specifically tuned to detect SQL injection patterns in GET and POST parameters, particularly targeting lists_show.php endpoints. Network-level controls such as restricting database access to only the application server IP addresses can also limit the blast radius if exploitation occurs. Regular security audits focusing on dynamic web applications and code reviews that enforce strict type checking for all user-supplied inputs are essential preventive measures against similar injection flaws in other modules of the software stack.