Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)

Admidio, an open-source user management system, is vulnerable to a second-order SQL injection in versions up to 5.0.6. The vulnerability resides in the MyList configuration feature, where authenticated users can define custom list column layouts. User-supplied column names, sort directions, and filter conditions are stored in the adm_list_columns table using prepared statements, ensuring safe storage. However, when the list is later displayed, these stored values are read back and directly interpolated into dynamically constructed SQL queries without any sanitization or parameterization, creating a classic second-order SQL injection (safe write, unsafe read) [1][3].

Exploitation occurs in two steps. First, an attacker with a valid account stores a malicious payload via the mylist_function.php module, where the only validation on column values is a prefix check (must start with usr_ or mem_); sort and filter values have no validation. Second, when the list is viewed via lists_show.php, the ListConfiguration::getSql() method reads the stored values and uses them directly in SQL SELECT, ORDER BY, and WHERE clauses. This allows the attacker to inject arbitrary SQL syntax at multiple points, including the lsc_special_field in the SELECT clause [2][3].

The impact is severe: an authenticated attacker can read, modify, or delete any data in the database, potentially achieving full database compromise [1][3]. The vulnerability does not require privileges beyond basic authentication, making it accessible to any user with the ability to configure list columns.

The issue has been fixed in Admidio version 5.0.7. Administrators are strongly advised to update to this patched version immediately [1][2]. The fix, visible in the commit at reference [2], modifies how special fields are handled and adds sanitization for stored values before their use in SQL queries. No known workarounds exist for unpatched versions.