CVE-2024-47836: Admidio vulnerable to HTML Injection In The Messages Section
Summary An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.
PoC 1. Go to https://www.admidio.org/demoen/admprogram/modules/messages/messages.php 2. Click on Send Private Message 3. In the Message field, enter the following payload Testing<br><h1>HTML</h1><br><h2>Injection</h2>
> !image
4. Send the message 5. Open the message again
> !image
Impact 1. Data Theft: Stealing sensitive information like cookies, session tokens, and user credentials. 2. Session Hijacking: Gaining unauthorized access to user accounts. 3. Phishing: Tricking users into revealing sensitive information. 4. Website Defacement: Altering the appearance or content of the website. 5. Malware Distribution: Spreading malware to users' devices. 6. Denial of Service (DoS): Overloading the server with malicious requests.
Other sources
Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Version 4.3.12 fixes this issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47836?
CVE-2024-47836 is classified as a critical severity vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2024-47836?
To remediate CVE-2024-47836, upgrade the Admidio software to version 4.3.12 or later.
Who is affected by CVE-2024-47836?
CVE-2024-47836 affects users of the Admidio software versions prior to 4.3.12.
What type of vulnerability is CVE-2024-47836?
CVE-2024-47836 is an unsafe deserialization vulnerability.
Can CVE-2024-47836 be exploited by unauthenticated users?
Yes, CVE-2024-47836 can be exploited by any unauthenticated user, allowing them to execute arbitrary code on the server.