CVE-2021-32630 Various
Authenticated attackers can upload malicious .phar files to execute arbitrary code via the document upload feature in Admidio.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32630?
CVE-2021-32630 is a critical vulnerability in admidio, published on 20 May 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents & Files upload feature. Someone with upload permissions could rename the php shell with a .phar extension, visit the file, triggering the payload for a reverse/bind shell. This can be mitigated by excluding a .phar file extension to be uploaded (like you did with .php .phtml .php5 etc). The vulnerability is patched in version 4.0.4.
Weakness: CWE-434
Which versions are affected by CVE-2021-32630?
It affects 1 product.
Products include Admidio Admidio.
How do I fix CVE-2021-32630?
No fix has been published for CVE-2021-32630 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-32630 being exploited?
There is no known exploitation of CVE-2021-32630 in the wild and no public exploit code.
Other vulnerabilities in admidio
- CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php
- CVE-2026-32817 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
- CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
- CVE-2026-32756 Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module
- CVE-2021-43810 Cross-site Scripting (XSS) when redirect an url
Sources
Also known as GHSA-xpqj-67r8-25j2.