8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32813

CVE-2026-32813: Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)

Admidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configuration feature. The MyList configuration feature lets authenticated users define custom list column layouts, storing user-supplied column names, sort directions, and filter conditions in the adm_list_columns table via prepared statements. However, these stored values are later read back and interpolated directly into dynamically constructed SQL queries without sanitization or parameterization, creating a classic second-order SQL injection vulnerability (safe write, unsafe read). An attacker can exploit this to inject arbitrary SQL, potentially reading, modifying, or deleting any data in the database and achieving full database compromise. This issue has been fixed in version 5.0.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32813

CVE-2026-32813:

8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.6	5.0.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the provided security advisory and the corresponding patch for the second-order SQL injection vulnerability in Admidio. The vulnerability existed because user-supplied data for list configurations was stored in the database with insufficient validation and later used in raw SQL query construction.

The function Admidio\Roles\Entity\ListConfiguration::addColumn served as the entry point, allowing malicious strings for column names (lsc_special_field), sort orders (lsc_sort), and filters (lsc_filter) to be saved to the database. The patch introduces strict allow-listing for column names and validates sort order values, preventing malicious data from being stored.

The primary exploitation occurs in two functions that read this stored data:

Admidio\Roles\Entity\ListConfiguration::getSql: This function retrieved the stored column and sort values and directly concatenated them into SELECT and ORDER BY clauses. The patch adds a defense-in-depth check against the same allowlist, ensuring that even if malicious data is already in the database, it is not used in the query.
Admidio\Roles\ValueObject\ConditionParser::makeSqlStatement: This function processed the stored filter conditions (lsc_filter). It was vulnerable because it built the WHERE clause by appending raw characters from the filter string. The patch remedies this by collecting the filter value and then applying proper escaping using $db->escapeString(), neutralizing any injected SQL syntax.

These three functions are the key runtime indicators for this vulnerability. An exploit would involve a call to addColumn to store the payload, followed by a call to getSql or makeSqlStatement (which is called by getSql) to trigger its execution.

Vulnerable functions

Admidio\Roles\Entity\ListConfiguration::getSql

src/Roles/Entity/ListConfiguration.php

This function constructs and returns an SQL query string. It was vulnerable because it retrieved stored column names (`lsc_special_field`) and sort orders (`lsc_sort`) from the database and directly interpolated them into the `SELECT` and `ORDER BY` clauses of the SQL query without sanitization or validation, leading to a second-order SQL injection.

Admidio\Roles\ValueObject\ConditionParser::makeSqlStatement

src/Roles/ValueObject/ConditionParser.php

This function was responsible for parsing user-defined filter conditions (`lsc_filter`) and converting them into an SQL `WHERE` clause. It was vulnerable because it appended raw characters from the stored filter value directly to the SQL query string, allowing an attacker to break out of the string context with a single quote and inject arbitrary SQL. The patch replaces direct concatenation with proper escaping using a database-specific function.

Admidio\Roles\Entity\ListConfiguration::addColumn

src/Roles/Entity/ListConfiguration.php

This function is the entry point for the malicious data. It accepted user-supplied column names (`lsc_special_field`) and sort orders (`lsc_sort`) and saved them to the database. Although the database write itself used prepared statements (making it a "safe write"), the function lacked proper validation, allowing malicious SQL fragments to be stored. This stored data was later used unsafely by `getSql()` and `makeSqlStatement()`, making `addColumn` a critical part of the second-order injection chain.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.