Isanghyeon

**Name of the Vulnerable Software and Affected Versions** Admidio versions prior to 5.0.12 **Description** An issue exists that allows unauthenticated attackers to execute arbitrary SQL queries. By providing a dummy UUID in the `role list` parameter, attackers can bypass authentication and use the `relation type list` parameter in the 'lists show.php' endpoint to extract sensitive database contents, such as user credentials and password hashes. This is achieved through blind SQL injection, a technique used to retrieve data from a database by asking a series of true or false questions based on the application's response. **Recommendations** Update to version 5.0.12 or later. Avoid using the `relation type list` parameter in the 'lists show.php' endpoint until the update is applied.