Vulnerability: SQL-injection in Admidio
Impact:
– Cross Site Scripting;
– Unauthorized manipulation of data.
Affected products: Admidio 2.x
Affected versions: Admidio 2.3.5, possibly earlier.
Description:
The vulnerability allows a remote user to execute arbitrary SQL commands in the application database.
1. The vulnerability is caused due to insufficient input validation in the parameter “headline” in the script adm_program / modules / guestbook / guestbook_new.php. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.
2. The vulnerability is caused due to insufficient input validation in the parameter “active_role” in script adm_program / modules / lists / lists.php. This can be exploited to execute arbitrary SQL commands in the application database.
Manufacturer URL: http://www.admidio.org/
Solution: Install the latest version 2.3.6 from the manufacturer.
links:
http://www.admidio.org/forum/viewtopic.php?t=5108
http://www.admidio.org/index.php?page=changelog_23
http://www.darksecurity.de/advisories/2012/SSCHADV2012-019.txt
