by Kastro
Paper/Archive/CVE-2021-32630

CVE-2021-32630

Admidio admidio — Various

EPSS 2%CVSS 9.6
critical.is priorityof 100
44
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 75.7.757 × 2015.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents & Files upload feature. Someone with upload permissions could rename the php shell with a .phar extension, visit the file, triggering the payload for a reverse/bind shell. This can be mitigated by excluding a .phar file extension to be uploaded (like you did with .php .phtml .php5 etc). The vulnerability is patched in version 4.0.4.

Affected

ProductAffectedFixed inSource
admidio< 4.0.4–CNA

Scores by source

GitHub_M (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References

refgithub.com/Admidio/admidio/security/advisories/GHSA-xpqj-67r8-25j2refgithub.com/Admidio/admidio/issues/994refgithub.com/Admidio/admidio/releases/tag/v4.0.4