GHSA-3x67-4c2c-w45m
High · 8.0Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
CVSS
8.0
EPSS
—
Published
Mar 16, 2026
CISA due date
—
The record
The MyList configuration feature in Admidio allows authenticated users to define custom list column layouts. User-supplied column names, sort directions, and filter conditions are stored in the `adm_list_columns` table via prepared statements (safe storage), but are later read back and interpolated directly into dynamically constructed SQL queries without sanitization or parameterization. This is a classic second-order SQL injection: safe write, unsafe read. An attacker can inject arbitrary SQL through these stored values to read, modify, or delete any data in the database, potentially achieving full database compromise.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-32813 Admidio is an open-source user management solution. Same vulnerability
- CVE-2026-87936 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89
- CVE-2026-87938 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89
- CVE-2026-114664 Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the… CWE-89
- CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. CWE-89
- CVE-2026-113406 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. CWE-89
- CVE-2026-113405 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. CWE-89
- CVE-2026-107081 SQL injection via identifier injection in the tableName and tableFields POST parameters… CWE-89