CVE-2025-62617 json
Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality
published 2025-10-22 12 mo ago modified 2026-10-19 21 d ago also EUVD-2025-35595 , GHSA-2v5m-cq9w-fc33
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. This issue has been patched in version 4.3.17.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 12 mo ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Admidio/admidio/security/advisories/GHSA-2v5m-cq9w-fc33 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | admidio/admidio | <4.3.17 |
4.3.17 |
Affected products
- Admidio admidio
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/Admidio/admidio/commit/fde81ae869e88a3cf42201f2548d57df785a37cb
web, patch
-
github.com
/Admidio/admidio/security/advisories/GHSA-2v5m-cq9w-fc33
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-62617
advisory
-
github.com
/Admidio/admidio
package
Sources
- CVE List CVE-2025-62617
- GitHub Advisory GHSA-2v5m-cq9w-fc33
- NVD CVE-2025-62617
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.