nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2018-25370 CVE-2018-25370
MEDIUM
Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php
Record summary
CVE-2018-25370 has a selected CVSS score of 6.9 (medium); EIP currently links 1 catalogued exploit.
Description
Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their permissions by exploiting improper origin checking. Attackers can craft malicious HTML forms targeting roles_function.php with parameters like rol_assign_roles, rol_approve_users, and rol_edit_user set to 1 to escalate privileges without authentication.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated May 26, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
AdmidioBrowse Admidio / Admidio | CVE List | 3.3.5 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBAdmidio 3.3.5 - Cross-Site Request Forgery (Change Permissions)ExploitDB exploitby Nawaf AlkeraitheNot analyzed1 file
References
5Product Referenceproduct
https://sourceforge.net/projects/admidio/files/Admidio/3.3.x/admidio-3.3.5.zip/download Official Product Homepageproduct
https://www.admidio.org/ ExploitDB-45322exploit
https://www.exploit-db.com/exploits/45322 VulnCheck Advisory: Admidio 3.3.5 Cross-Site Request Forgery via roles_function.phpThird-party advisory
https://www.vulncheck.com/advisories/admidio-cross-site-request-forgery-via-roles-function-php