CVE-2024-47836

Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Version 4.3.12 fixes this issue...

Cross-site Scripting (XSS)

Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the messages section. An attacker can manipulate the displayed content and potentially execute harmful...

GHSA-7C4C-749J-PFP2 Admidio Vulnerable to HTML Injection In The Messages Section

Summary An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. PoC 1. Go to https://www.admidio.org/demoen/admprogram/modules/messages/messages.php 2. Click on Send Private Message 3. In the Message field, enter the following payload...

Admidio Vulnerable to HTML Injection In The Messages Section

Summary An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. PoC 1. Go to https://www.admidio.org/demoen/admprogram/modules/messages/messages.php 2. Click on Send Private Message 3. In the Message field, enter the following payload...

CVE-2024-47836 Admidio vulnerable to HTML Injection In The Messages Section

Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Version 4.3.12 fixes this issue...

CVE-2024-47836 Admidio vulnerable to HTML Injection In The Messages Section

Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Version 4.3.12 fixes this issue...

CVE-2024-47836 Admidio vulnerable to HTML Injection In The Messages Section

Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Version 4.3.12 fixes this issue...

CVE-2024-47836

Admidio CVE-2024-47836 affects versions prior to 4.3.12. The vulnerability is an unsafe deserialization flaw that allows any unauthenticated user to execute arbitrary code on the server. The issue is fixed in version 4.3.12. Public references describe potential impacts (data theft, session hijack...

Admidio Vulnerable to HTML Injection In The Messages Section

An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server...

Admidio 代码问题漏洞

Admidio is an open source member management system from the Admidio team. The system supports features such as member lists, event management, guestbooks, photo albums and downloads. A code issue vulnerability exists in versions prior to Admidio 4.3.12 that stems from the presence of an insecure...

PT-2024-32844 · Admidio · Admidio

Name of the Vulnerable Software and Affected Versions: Admidio versions prior to 4.3.12 Description: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. This issue can lead to various impacts, including data theft, session hijacking,...

The vulnerability of the Message module in the Admidio membership management and access control application allows a perpetrator to execute arbitrary code.

The vulnerability of the Message module in the Admidio membership and access control application relates to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability in the `ecard_send.php` script of the Admidio membership and access control application allows a perpetrator to execute arbitrary code and gain access to read, modify, or delete data.

The vulnerability in the ecardsend.php script /admprogram/modules/ecards/ecardsend.php of the Admidio membership and access control application relates to the improper elimination of special elements used in SQL queries when processing the ecardrecipients parameter. Exploiting this vulnerability...

Remote Code Execution (RCE)

admidio/admidio is vulnerable to Remote Code Execution RCE. The vulnerability is due to lack of file extension verification and public file upload availability in the Message module's attachment. This vulnerability allows malicious files to be uploaded and accessed publicly, resulting in RCE...

Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

Description: Remote Code Execution Vulnerability has been identified in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The uploaded file can be accessed publicly through the URL admidiobaseurl/admmyfiles/messagesattachments/filename. Th...

GHSA-G872-JWWR-VGGM Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

Description: Remote Code Execution Vulnerability has been identified in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The uploaded file can be accessed publicly through the URL admidiobaseurl/admmyfiles/messagesattachments/filename. Th...

Admidio has Blind SQL Injection in ecard_send.php

Description: An SQL Injection has been identified in the /admprogram/modules/ecards/ecardsend.php source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of ecardrecipients POST parameter is being directly concatenated with the SQ...

GHSA-69WX-XC6J-28V3 Admidio has Blind SQL Injection in ecard_send.php

Description: An SQL Injection has been identified in the /admprogram/modules/ecards/ecardsend.php source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of ecardrecipients POST parameter is being directly concatenated with the SQ...

CVE-2024-37906

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the /admprogram/modules/ecards/ecardsend.php source file of the Admidio Application. The SQL Injection results in a compromise of the...

CVE-2024-38529

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The...