PT-2025-43410 · Admidio · Admidio

Published

2025-10-22

·

Updated

2025-10-27

·

CVE-2025-62617

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Admidio versions prior to 4.3.17
Description Admidio, a user management solution, contains a SQL injection issue in the member assignment data retrieval functionality. An authenticated user with role assignment permissions can execute arbitrary SQL commands, potentially leading to a full compromise of the application's database, including data reading, modification, and deletion. The vulnerability resides in the adm program/modules/groups-roles/members assignment data.php script, specifically in how the filter rol uuid GET parameter is handled. The parameter is not sufficiently sanitized before being used in a raw SQL query. The vulnerable code directly concatenates the filter rol uuid variable into the SQL query, allowing an attacker to inject malicious SQL code. The vulnerable file is adm program/modules/groups-roles/members assignment data.php. The vulnerable parameter is filter rol uuid.
Recommendations Update to Admidio version 4.3.17 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-62617
GHSA-2V5M-CQ9W-FC33

Affected Products

Admidio