Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.0.17
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Admidio, an open-source membership and event management web application, is affected. An authenticated member can bypass the event guest restriction and register guests even when they are not allowed, using up an event's remaining seats and preventing other members from signing up.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- admidio admidio
fixed in 5.0.17