CVE-2024-37906
CVE-2024-37906 · Admidio has Blind SQL Injection in ecard_send.php
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9.
CVSS 10.0 · Critique · EPSS 0,9% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
admidio
- Versions du logiciel
- < 4.3.9: Concernée
Aucun correctif publié
admidio/admidio Packagist
- Versions du logiciel
- 4.1.0
- 4.1.3
- v4.2-Beta.1
- v4.2-Beta.2
- v4.2-Beta.3
- v4.2.0
- v4.2.1
- v4.2.10
- v4.2.11
- v4.2.12
- v4.2.13
- v4.2.14
- v4.2.2
- v4.2.3
- v4.2.4
- v4.2.5
- v4.2.6
- v4.2.7
- v4.2.8
- v4.2.9
- v4.3-Beta.1
- v4.3-Beta.3
- v4.3-Beta.4
- v4.3-Beta.5
- v4.3.0
- v4.3.1
- v4.3.2
- v4.3.3
- v4.3.4
- v4.3.5
- v4.3.6
- v4.3.7
- v4.3.8
- Plages de versions concernées
- ECOSYSTEM: < 4.3.9
Mettez à jour vers 4.3.9