High · published October 23, 2025
⚡ An authenticated SQL injection vulnerability lurks in Admidio, allowing savvy users to execute arbitrary SQL commands simply by having member assignment permissions. This is a real red flag! 🚩 Think of it like a restaurant where a waiter has the power to not only take orders but also rewrite the menu. If that waiter can change the ingredients of every dish on the fly, chaos ensues! 🍽️ An attacker with proper credentials could waltz right in and take control of the entire database: reading, modifying, or even deleting crucial data. This could lead to devastating consequences for user privacy and application integrity—absolute mayhem for your data! 🔥
Think of it like a restaurant where a waiter has the power to not only take orders but also rewrite the menu. If that waiter can change the ingredients of every dish on the fly, chaos ensues! 🍽️ This vulnerability exists in Admidio prior to version 4.3.17, where authenticated users with assignment permissions can exploit the member assignment data retrieval function to execute arbitrary SQL commands against the database.
An attacker with proper credentials could waltz right in and take control of the entire database: reading, modifying, or even deleting crucial data. This could lead to devastating consequences for user privacy and application integrity—absolute mayhem for your data! 🔥 Patch immediately to version 4.3.17 to close this security hole. Review user permissions carefully to ensure only trusted individuals can assign roles. As a best practice, audit your SQL queries to guard against such attacks in the future. You’ve got this! By following these steps, you’ll strengthen your defenses and protect your application. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| admidio/admidio | < 4.3.17 | 4.3.17 |