An unauthenticated SQL injection vulnerability in Admidio versions prior to 5.0.12 poses a critical risk of full database compromise and unauthorized credential exposure.

The application fails to properly sanitize the relation_type_list parameter in lists_show.php. Unauthenticated attackers can leverage this flaw to execute arbitrary SQL commands, potentially bypassing authentication mechanisms and exfiltrating sensitive data.

This vulnerability carries a CVSS score of 7.5, indicating a high level of risk to organizational data integrity and confidentiality. Successful exploitation allows an attacker to dump the backend database, leading to the exposure of password hashes, user information, and other proprietary data. Such a breach could result in significant reputational damage and widespread unauthorized access to the Admidio platform.

Immediate Action: Upgrade to Admidio version 5.0.12 or newer immediately to incorporate the security patches provided by the vendor.

Proactive Monitoring: Review database access logs for anomalous query patterns, particularly those originating from the lists_show.php endpoint, which may indicate attempted exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the relation_type_list parameter until the application can be updated.

Public Exploit Available: Unknown

Given the ease with which unauthenticated attackers can extract database contents, this vulnerability should be treated with high priority. Organizations using Admidio must verify their current version and apply the 5.0.12 update without delay to prevent potential data breaches.