CVE-2026-32813

{"id": "CVE-2026-32813", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32813", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-20T14:39:25.477961Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Admidio", "product": "admidio", "versions": [{"status": "affected", "version": "< 5.0.7"}]}]}], "published": "2026-03-20T02:16:35.210", "references": [{"url": "https://github.com/Admidio/admidio/commit/3473bf5a7aa1bfc5043e73979719396276f4189f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-3x67-4c2c-w45m", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-3x67-4c2c-w45m", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configuration feature. The MyList configuration feature lets authenticated users define custom list column layouts, storing user-supplied column names, sort directions, and filter conditions in the adm_list_columns table via prepared statements. However, these stored values are later read back and interpolated directly into dynamically constructed SQL queries without sanitization or parameterization, creating a classic second-order SQL injection vulnerability (safe write, unsafe read). An attacker can exploit this to inject arbitrary SQL, potentially reading, modifying, or deleting any data in the database and achieving full database compromise. This issue has been fixed in version 5.0.7."}, {"lang": "es", "value": "Admidio es una soluci\u00f3n de gesti\u00f3n de usuarios de c\u00f3digo abierto. Las versiones 5.0.6 e inferiores son vulnerables a inyecci\u00f3n SQL arbitraria a trav\u00e9s de la caracter\u00edstica de configuraci\u00f3n MyList. La caracter\u00edstica de configuraci\u00f3n MyList permite a los usuarios autenticados definir dise\u00f1os de columnas de lista personalizados, almacenando nombres de columna, direcciones de ordenaci\u00f3n y condiciones de filtro proporcionados por el usuario en la tabla adm_list_columns a trav\u00e9s de sentencias preparadas. Sin embargo, estos valores almacenados se leen posteriormente y se interpolan directamente en consultas SQL construidas din\u00e1micamente sin sanitizaci\u00f3n ni parametrizaci\u00f3n, creando una vulnerabilidad de inyecci\u00f3n SQL de segundo orden cl\u00e1sica (escritura segura, lectura insegura). Un atacante puede explotar esto para inyectar SQL arbitrario, potencialmente leyendo, modificando o eliminando cualquier dato en la base de datos y logrando un compromiso total de la base de datos. Este problema ha sido corregido en la versi\u00f3n 5.0.7."}], "lastModified": "2026-06-17T10:36:23.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3347E657-D132-4D87-A355-391136657A27", "versionEndExcluding": "5.0.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}