PT-2026-43222 · Undefined · Undefined

Published 2026-05-25 · Updated 2026-05-25 · CVE-2018-25370

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their permissions by exploiting improper origin checking. Attackers can craft malicious HTML forms targeting roles function.php with parameters like rol assign roles, rol approve users, and rol edit user set to 1 to escalate privileges without authentication.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-25370

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-25370 · Security Note
• https://sourceforge.net/projects/admidio/files/Admidio/3.3.x/admidio-3.3.5.zip/download · Note
• https://admidio.org · Note
• https://exploit-db.com/exploits/45322 · Note
• https://vulncheck.com/advisories/admidio-cross-site-request-forgery-via-roles-function-php · Note