CVE-2026-82655: Admidio before 5.0.12 SQL Injection via relation_type_list
Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relationtypelist parameter of listsshow.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in rolelist and inject SQL through relationtypelist to extract database contents including password hashes and user credentials.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Admidio installations running versions before 5.0.12 are exposed. The issue is reachable remotely and does not require an authenticated account or user interaction.
What does an attacker need to exploit this issue?
An attacker needs to send requests to lists_show.php with a dummy UUID supplied in role_list and crafted SQL input in relation_type_list. No privileges are required.
What could an attacker obtain?
An attacker can execute arbitrary SQL queries through blind SQL injection and extract database contents. The described impact includes password hashes and user credentials.
How can I determine whether my deployment is affected?
Check the installed Admidio version. Versions before 5.0.12 are affected; the provided data does not identify any configuration prerequisite or mitigation other than using a version that is not before 5.0.12.