CyberRota Analysis
AI-GeneratedAdmidio versions prior to 5.0.11 are vulnerable to an insecure direct object reference in the save_temporary mode of mylist_function.php, allowing authenticated users to manipulate list configurations. This vulnerability enables attackers to enumerate global list UUIDs and overwrite both admin-curated global lists and private lists of other users, potentially compromising data integrity and access controls. Organizations using Admidio should prioritize patching to mitigate the risk of unauthorized list manipulation and data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_function.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' private lists by supplying a list_uuid parameter, transferring ownership and demoting global lists to personal configurations.