← Vulnerability feed

Vulnerability record · CVE-2024-37906 · published 29 July 2024

CVE-2024-37906: Admidio sql injection vulnerability

Admidio · Admidio

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9.

8.8 CVSS 3.1 High EPSS 0.93% · top 40.9% CWE-89 · SQL injection
8.8CVSS 3.1 base score
0.93%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Admidio/admidio/commit/3ff02b0c64a6911ab3e81cd61077f392c0b25248 Patch
https://github.com/Admidio/admidio/security/advisories/GHSA-69wx-xc6j-28v3 ExploitVendor Advisory
https://github.com/Admidio/admidio/commit/3ff02b0c64a6911ab3e81cd61077f392c0b25248 Patch
https://github.com/Admidio/admidio/security/advisories/GHSA-69wx-xc6j-28v3 ExploitVendor Advisory

Track CVE-2024-37906 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-32817Admidio missing authorization vulnerabilityAdmidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the curre…EPSS 0.48%8.8CVE-2026-32756Admidio unrestricted file upload vulnerabilityAdmidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documen…EPSS 0.95%8.8CVE-2024-38529Admidio unrestricted file upload vulnerabilityAdmidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote C…EPSS 1.2%8.8CVE-2021-32630Admidio unrestricted file upload vulnerabilityAdmidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenti…EPSS 1.6%8.0CVE-2026-32813Admidio sql injection vulnerabilityAdmidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configurati…EPSS 0.42%7.8CVE-2023-3302Admidio csv injection vulnerabilityImproper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.EPSS 0.46%7.5CVE-2026-34381Admidio improper access control vulnerabilityAdmidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny dire…EPSS 0.52%7.5CVE-2020-11004Admidio sql injection vulnerabilitySQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validatio…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2024-37906), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.