MALWARELIST.net – Your Information Security Source

Vulnerability: SQL-injection in Admidio

Impact:

– Cross Site Scripting;
– Unauthorized manipulation of data.

Affected products: Admidio 2.x

Affected versions: Admidio 2.3.5, possibly earlier.

Description:

The vulnerability allows a remote user to execute arbitrary SQL commands in the application database.

1. The vulnerability is caused due to insufficient input validation in the parameter “headline” in the script adm_program / modules / guestbook / guestbook_new.php. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

2. The vulnerability is caused due to insufficient input validation in the parameter “active_role” in script adm_program / modules / lists / lists.php. This can be exploited to execute arbitrary SQL commands in the application database.

Manufacturer URL: http://www.admidio.org/

Solution: Install the latest version 2.3.6 from the manufacturer.

links:

http://www.admidio.org/forum/viewtopic.php?t=5108
http://www.admidio.org/index.php?page=changelog_23
http://www.darksecurity.de/advisories/2012/SSCHADV2012-019.txt