Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
Date: 2026-03
Affected: composer/admidio/admidio
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-32813
CWE: CWE-89
CVSS: 8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)

## Summary The MyList configuration feature in Admidio allows authenticated users to define custom list column layouts. User-supplied column names, sort directions, and filter conditions are stored in the `adm_list_columns` table via prepared statements (safe storage), but are later read back and interpolated directly into dynamically constructed SQL queries without sanitization or parameterization. This is a classic second-order SQL injection: safe write, unsafe read. An attacker can inject arbitrary SQL through these stored values to read, modify, or delete any data in the database, potentially achieving full database compromise. ## Details ### Step 1: Storing the Payload (Safe Write) In `modules/groups-roles/mylist_function.php` (lines 89-115), user-supplied POST array values for column names, sort directions, and filter conditions are accepted. The only validation on column values is a prefix check (must start with `usr_` or `mem_`). Sort and condition values have no validation at all. These values are stored in the database via `ListConfiguration::addColumn()` which calls `Entity::save()` using prepared statements -- so the INSERT/UPDATE is safe. Key source file references: - `D:\bugcrowd\admidio\repo\modules\groups-roles\mylist_function.php` lines 89-115 - `D:\bugcrowd\admidio\repo\src\Roles\Entity\ListConfiguration.php` lines 106-116 ### Step 2: Triggering the Payload (Unsafe Read) When the list is viewed (via `lists_show.php`), `ListConfiguration::getSql()` re


Mitigations:

Architectural layers (MAESTRO):