Paper/Archive/CVE-2024-37906

CVE-2024-37906

Admidio admidio — Admidio has Blind SQL Injection in ecard_send.php

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 60.7.607 × 2012.1 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9.

Affected

ProductAffectedFixed inSource

admidio< 4.3.9–CNA

admidio< 4.3.94.3.9CISA-ADP

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/Admidio/admidio/security/advisories/GHSA-69wx-xc6j-28v3 refgithub.com/Admidio/admidio/commit/3ff02b0c64a6911ab3e81cd61077f392c0b25248