CVE-2025-62617

Katalog CVE

CVSS 7.2 · High EPSS 0,43%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada admidio. Skor CVSS 3.1 7.2 (High) menurut github.com.

Deskripsi (NVD)

Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. This issue has been patched in version 4.3.17.

Rincian

Terbit di NVD

22 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Admidio/admidio/security/advisories/GHSA-2v5m-cq9w-fc33 exploit · advisory vendor
• https://github.com/Admidio/admidio/commit/fde81ae869e88a3cf42201f2548d57df785a37cb patch