CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
Attackers can upload PHP files to achieve remote code execution due to missing file extension checks in the message attachment module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-38529?
CVE-2024-38529 is a critical vulnerability in admidio, published on 29 Jul 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The uploaded file can be accessed publicly through the URL `{admidio_base_url}/adm_my_files/messages_attachments/{file_name}`. The vulnerability is caused due to the lack of file extension verification, allowing malicious files to be uploaded to the server and public availability of the uploaded file. This vulnerability is fixed in 4.3.10.
Weakness: CWE-434
Which versions are affected by CVE-2024-38529?
2 open source packages ship an affected version, including admidio/admidio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
admidio/admidio Packagist | All versions | 4.3.10 |
admidio/admidio Packagist | All versions | 4.3.10 |
Products include Admidio Admidio.
How do I fix CVE-2024-38529?
Upgrade admidio/admidio to 4.3.10 or later.
Is CVE-2024-38529 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-38529 exists.
Other vulnerabilities in admidio
- CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php
- CVE-2021-32630 Various
- CVE-2026-32817 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
- CVE-2026-32756 Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module
- CVE-2021-43810 Cross-site Scripting (XSS) when redirect an url
Sources
Also known as GHSA-g872-jwwr-vggm.