Vulnerability · Published May 20, 2021 · Assigned by GitHub_M

CVE-2021-32630Various

Critical 9.6

In plain English

A critical-severity unrestricted file upload in admidio from Admidio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)1.6%top 24.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents & Files upload feature. Someone with upload permissions could rename the php shell with a .phar extension, visit the file, triggering the payload for a reverse/bind shell. This can be mitigated by excluding a .phar file extension to be uploaded (like you did with .php .phtml .php5 etc). The vulnerability is patched in version 4.0.4.

Affected products (as reported)

Vendor	Product	Versions
Admidio	admidio	< 4.0.4

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/Admidio/admidio/security/advisories/GHSA-xpqj-67r8-25j2 x_refsource_CONFIRM
https://github.com/Admidio/admidio/issues/994 x_refsource_MISC
https://github.com/Admidio/admidio/releases/tag/v4.0.4 x_refsource_MISC