CVE-2024-37906
CVSS V2 None
CVSS V3 None
Description
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9.
Overview
- CVE ID
- CVE-2024-37906
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-07-29T14:22:57.188Z
- Last Modified Date
- 2024-07-29T15:09:45.520Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/Admidio/admidio/security/advisories/GHSA-69wx-xc6j-28v3 | x_refsource_CONFIRM |
| https://github.com/Admidio/admidio/commit/3ff02b0c64a6911ab3e81cd61077f392c0b25248 | x_refsource_MISC |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-37906 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37906 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-07-30 13:03:43 | Added to TrackCVE |