GitHub Advisoryadvisory · Packagist
GHSA-7c4c-749j-pfp2 Admidio Vulnerable to HTML Injection In The Messages Section
LOW
Official page ↗
- Aliases
- CVE-2024-47836
- Ecosystem
- Packagist
- Packages
- admidio/admidio
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-502, CWE-79
- Reviewed
- 2024-10-16
Affected packages
• Packagist admidio/admidio: < 4.3.12 → fixed in 4.3.12
Description
Summary
An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.
PoC
1. Go to
https://www.admidio.org/demo_en/adm_program/modules/messages/messages.php
2. Click on Send Private Message
3. In the `Message` field, enter the following payload
`TestingHTMLInjection`
>
4. Send the message
5. Open the message again
>
Impact
1. Data Theft: Stealing sensitive information like cookies, session tokens, and user credentials.
2. Session Hijacking: Gaining unauthorized access to user accounts.
3. Phishing: Tricking users into revealing sensitive information.
4. Website Defacement: Altering the appearance or content of the website.
5. Malware Distribution: Spreading malware to users' devices.
6. Denial of Service (DoS): Overloading the server with malicious requests.
Related
Alias · CVE (1)
- CVE-2024-47836 Admidio is an open-source user management solution. vulnerability