Arbitrary file upload in Admidio
CVE-2021-32630
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents & Files upload feature. Someone with upload permissions could rename the php shell with a .phar extension, visit the file, triggering the payload for a reverse/bind shell. This can be mitigated by excluding a .phar file extension to be uploaded (like you did with .php .phtml .php5 etc). The vulnerability is patched in version 4.0.4.
Vulnerability class: Unrestricted File Upload
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.016 (74.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 74.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- Admidio — versions < 4.0.4
Weakness classification (CWE)
References
- github.com/Admidio/admidio/security/advisories/GHSA-xpqj-67r8-25j2 (Exploit, Third Party Advisory)
- github.com/Admidio/admidio/issues/994 (Third Party Advisory)
- github.com/Admidio/admidio/releases/tag/v4.0.4 (Third Party Advisory, Release Notes)
Frequently asked questions
- What is CVE-2021-32630?
- CVE-2021-32630 is a critical-severity vulnerability in Admidio, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.6/10. Published 2021-05-20.
- How severe is CVE-2021-32630?
- Critical severity. CVSS v3 base score is 9.6 out of 10.