CVE-2025-62617

Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. This issue has been patched in version 4.3.17.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Admidio/admidio/commit/fde81ae869e88a3cf42201f2548d57df785a37cb	Patch
https://github.com/Admidio/admidio/security/advisories/GHSA-2v5m-cq9w-fc33	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Admidio es una solución de gestión de usuarios de código abierto. Antes de la versión 4.3.17, existe una vulnerabilidad de inyección SQL autenticada en la funcionalidad de recuperación de datos de asignación de miembros de Admidio. Cualquier usuario autenticado con permisos para asignar miembros a un rol (como un administrador) puede explotar esta vulnerabilidad para ejecutar comandos SQL arbitrarios. Esto puede llevar a un compromiso total de la base de datos de la aplicación, incluyendo la lectura, modificación o eliminación de todos los datos. Este problema ha sido parcheado en la versión 4.3.17.

Information

Published : 2025-10-22 22:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-62617

Mitre link : CVE-2025-62617

CVE.ORG link : CVE-2025-62617

JSON object : View

Products Affected

admidio

admidio

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-62617", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62617", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-23T16:03:08.051767Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Admidio", "product": "admidio", "versions": [{"status": "affected", "version": "< 4.3.17"}]}]}], "published": "2025-10-22T22:15:34.400", "references": [{"url": "https://github.com/Admidio/admidio/commit/fde81ae869e88a3cf42201f2548d57df785a37cb", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-2v5m-cq9w-fc33", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. This issue has been patched in version 4.3.17."}, {"lang": "es", "value": "Admidio es una soluci\u00f3n de gesti\u00f3n de usuarios de c\u00f3digo abierto. Antes de la versi\u00f3n 4.3.17, existe una vulnerabilidad de inyecci\u00f3n SQL autenticada en la funcionalidad de recuperaci\u00f3n de datos de asignaci\u00f3n de miembros de Admidio. Cualquier usuario autenticado con permisos para asignar miembros a un rol (como un administrador) puede explotar esta vulnerabilidad para ejecutar comandos SQL arbitrarios. Esto puede llevar a un compromiso total de la base de datos de la aplicaci\u00f3n, incluyendo la lectura, modificaci\u00f3n o eliminaci\u00f3n de todos los datos. Este problema ha sido parcheado en la versi\u00f3n 4.3.17."}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "598B27C3-0068-48FF-BA50-BC940B161496", "versionEndExcluding": "4.3.17"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}