Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality
Date: 2025-10
Affected: composer/admidio/admidio
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-62617
CWE: CWE-89
CVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

### Summary An authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. The vulnerability is present in the latest version, 4.3.16. ### Details The vulnerability is located in the `adm_program/modules/groups-roles/members_assignment_data.php` script. This script handles an AJAX request to fetch a list of users for role assignment. The `filter_rol_uuid` GET parameter is not properly sanitized before being used in a raw SQL query. **File:** `adm_program/modules/groups-roles/members_assignment_data.php` ```php // ... // The parameter is retrieved from the GET request without sufficient sanitization for SQL context. $getFilterRoleUuid = admFuncVariableIsValid($_GET, 'filter_rol_uuid', 'string'); $getMembersShowAll = admFuncVariableIsValid($_GET, 'mem_show_all', 'bool', array('defaultValue' => false)); // ... $filterRoleCondition = ''; if ($getMembersShowAll) { $getFilterRoleUuid = 0; } else { // show only members of current organization if ($getFilterRoleUuid !== '') { // VULNERABLE CODE: $getFilterRoleUuid is directly concatenated into the query string. $filterRoleCondition = ' AND rol_uuid = \''.$getFilterRoleUui


Mitigations:

Architectural layers (MAESTRO):