CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php

2024-07-2914:22:57

CWE-89

GitHub_M

www.cve.org

admidio

sql injection

ecard_send.php

security vulnerability

database compromise

member user

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

Percentile

9.4%

JSON

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the /adm_program/modules/ecards/ecard_send.php source file of the Admidio Application. The SQL Injection results in a compromise of the application’s database. The value of ecard_recipients POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9.

CNA Affected

[
  {
    "vendor": "Admidio",
    "product": "admidio",
    "versions": [
      {
        "version": "< 4.3.9",
        "status": "affected"
      }
    ]
  }
]