High severity · published Apr 24, 2020
CVE-2020-11004
SQL Injection was discovered in Admidio before version 3.3.13
7.5
CVSS
1.5%
EPSS
No
On KEV
Description
SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulnerability impacts the confidentiality of the system. This has been patched in version 3.3.13.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Admidio · Admidio
before 3.3.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11004
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11004
Patch
https://github.com/Admidio/admidio/commit/ea5d6f114b151ed11ec0ad7cb47bd729e77a874a
Third Party Advisory
https://github.com/Admidio/admidio/issues/908
Third Party Advisory
https://github.com/Admidio/admidio/security/advisories/GHSA-qh57-rcff-gx54
More from Admidio
9.1
CVE-2026-32817
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
8.8
CVE-2026-32756
Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module
8.8
CVE-2024-38529
Admidio is a free, open source user management system for websites of organizations and groups
8.8
CVE-2024-37906
Admidio is a free, open source user management system for websites of organizations and groups
8.8
CVE-2021-32630
Admidio is a free, open source user management system for websites of organizations and groups