Remote Code Execution Vulnerability in Admidio Message Module

CVE-2024-38529

What is CVE-2024-38529?

The Admidio User Management System, utilized by various organizations and groups, has a significant security flaw in its Message module affecting versions prior to 4.3.10. This vulnerability allows remote attackers to execute arbitrary code through the upload of malicious PHP files due to inadequate file extension validation. As a result, these files can be publicly accessed via a predictable URL format, leading to potential exploitation. Users and administrators are strongly advised to upgrade to version 4.3.10 or later to mitigate this risk and secure their applications against unauthorized access.

References