Admidio CVE-2025-62617

Requires an authenticated Admidio account that holds the permission to assign members to a role (administrator or an equivalently privileged role), consistent with CVSS PR:H. The injection point is the filter_rol_uuid GET parameter of the adm_program/modules/groups-roles/members_assignment_data.php AJAX endpoint, where the value is concatenated directly into a raw SQL subselect without sanitization. Exploitation is network-reachable and needs no user interaction, but is strictly limited to users who already possess role-assignment privileges and only affects Admidio versions <= 4.3.16 (fixed in 4.3.17); it is not exploitable by anonymous or low-privilege users.

This is a genuine but privilege-gated issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH) is internally consistent with the description: exploitation is network-reachable over the AJAX endpoint, low-complexity, needs no user interaction, and yields full confidentiality/integrity/availability impact on the database - but it explicitly requires high privileges (PR:H). The limiting factor is that the attacker must already be an authenticated user holding the permission to assign members to a role, i.e. effectively an administrator or similarly trusted operator, so the realistic threat is a malicious or compromised privileged account escalating from role-management rights to full database control. Public exploit code exists via the GitHub Security Advisory (GHSA-2v5m-cq9w-fc33) and the fix commit discloses the exact vulnerable parameter, which lowers the bar to reproduce it. No CISA KEV listing and no EPSS score were provided in the input, so there is no evidence of active or widespread exploitation; given the high-privilege precondition and the niche, self-hosted nature of the product, targeted abuse by an insider or via a hijacked admin session is far more plausible than mass exploitation. Net: a real priority for organizations running Admidio < 4.3.17 (patch promptly), but the PR:H gate keeps real-world risk below what the 7.2 score alone might suggest for a classic unauthenticated SQLi.

A logged-in Admidio user who holds the 'assign members to a role' permission (typically an administrator) sends a crafted AJAX request to members_assignment_data.php with a malicious filter_rol_uuid value, breaking out of the SQL string literal to inject arbitrary SQL into the member-count subselect. Because public exploit details and the vulnerable parameter are disclosed in the GitHub advisory and fix commit, the attacker can reliably read, modify, or delete any data in the application database. Exploitation is network-based and low-complexity but requires the attacker to already possess a high-privilege authenticated session.