CyberRota Analysis
AI-GeneratedAdmidio versions prior to 5.0.12 are vulnerable to a blind SQL injection in the relation_type_list parameter of lists_show.php, enabling unauthenticated attackers to execute arbitrary SQL queries. This vulnerability allows attackers to bypass authentication and potentially extract sensitive database contents, including password hashes and user credentials. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in role_list and inject SQL through relation_type_list to extract database contents including password hashes and user credentials.