A second‑order SQL injection flaw in Admidio allows an attacker to execute arbitrary SQL commands. The vulnerability is triggered when user‑supplied column names, sort orders, and filter conditions are stored via prepared statements but later embedded unsanitized into dynamically constructed SQL queries. Successful exploitation can read, modify, or delete any database content, effectively compromising the entire data store.

Admidio versions 5.0.6 and earlier are affected. The issue resides in the MyList configuration feature that permits authenticated users to define custom list layouts.

The CVSS score of 8 indicates high risk, and the EPSS score below 1% reflects a low probability of exploitation in the wild. The vulnerability is not listed as a known exploited vulnerability by CISA. Attackers would need valid user credentials to configure the list, after which the stored inputs are later used in an unsafe query. Once the second‑order injection is triggered, the attacker gains full database control.