PT-2026-43222 · Undefined · Undefined

CVE-2018-25370 · Publicado 2026-05-25 · Atualizado 2026-05-25

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their permissions by exploiting improper origin checking. Attackers can craft malicious HTML forms targeting roles function.php with parameters like rol assign roles, rol approve users, and rol edit user set to 1 to escalate privileges without authentication.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-25370

Produtos afetados

Undefined

Referências · 5

• https://vulncheck.com/advisories/admidio-cross-site-request-forgery-via-roles-function-php · Nota
• https://sourceforge.net/projects/admidio/files/Admidio/3.3.x/admidio-3.3.5.zip/download · Nota
• https://admidio.org · Nota
• https://exploit-db.com/exploits/45322 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-25370 · Nota de Segurança