GitHub Advisoryadvisory · Packagist
GHSA-c4v8-2hg8-jv77 admidio CSRF Vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2017-8382
- Ecosystem
- Packagist
- Packages
- admidio/admidio
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-352
- Reviewed
- 2023-07-27
Affected packages
• Packagist admidio/admidio: < 4.1-Beta.1 → fixed in 4.1-Beta.1
Description
admidio 3.2.8 has CSRF in `adm_program/modules/members/members_function.php` with an impact of deleting arbitrary user accounts.
Related
Alias · CVE (1)
- CVE-2017-8382 admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts. vulnerability
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-8382 advisory
- https://github.com/Admidio/admidio/issues/612 web
- https://github.com/Admidio/admidio/pull/1074 web
- https://github.com/Admidio/admidio/commit/a7ac9d3c9e0780e877fe9ac846ac64b284de8553 web
- https://github.com/Admidio/admidio package
- https://github.com/faizzaidi/Admidio-3.2.8-CSRF-POC-by-Provensec-llc web
- https://www.exploit-db.com/exploits/42005 web
- http://en.0day.today/exploit/27771 web