A second-order SQL injection vulnerability in Admidio allows authenticated attackers to gain full database compromise.

This is a second-order SQL injection flaw (CWE-89) occurring because user-supplied configuration data in the MyList feature is unsafely interpolated into dynamic SQL queries. The attack requires an authenticated user with access to the MyList configuration to trigger the payload.

The vulnerability carries a CVSS score of 8.0, reflecting its high potential for total data compromise. Successful exploitation grants an attacker the ability to read, modify, or delete sensitive data stored within the database, which could lead to unauthorized access to user accounts and widespread information disclosure.

Immediate Action: Update the Admidio installation to version 5.0.7 or later to implement the necessary input sanitization and parameterization.

Proactive Monitoring: Review database access logs for unusual queries originating from the MyList configuration feature, specifically looking for SQL syntax characters or unexpected table access patterns.

Compensating Controls: Deploy a Web Application Firewall with SQL injection protection rules enabled to monitor and block malicious input patterns directed at the application's configuration endpoints.

Public Exploit Available: No (exploit_available: false)

Given the potential for full database compromise, this vulnerability poses a significant risk to the integrity and confidentiality of the Admidio platform. Administrators should prioritize upgrading to version 5.0.7 immediately to eliminate the underlying flaw and prevent potential exploitation by authenticated users.