An authenticated SQL injection vulnerability in Admidio versions prior to 4.3.17 could allow an attacker with specific role-based permissions to compromise the entire application database.

This vulnerability is an instance of SQL Injection (CWE-89) residing in the member assignment data retrieval function. It requires an authenticated user with existing permissions to assign members to a role to successfully trigger the flaw.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries against the underlying database. This presents a high risk of unauthorized data access, modification, or total destruction of application records, which correlates with the CVSS score of 7.2. Such an incident could result in significant data breaches and a complete loss of integrity for the user management system.

Immediate Action: Update the Admidio installation to version 4.3.17 or later to resolve the underlying SQL injection flaw.

Proactive Monitoring: Review database audit logs for unusual query patterns or unexpected attempts to access tables outside the scope of normal member assignment operations.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the application's member management endpoints.

Public Exploit Available: No

Given the potential for full database compromise, administrators should prioritize updating to version 4.3.17 immediately. Organizations should also verify the principle of least privilege for all accounts with role-assignment capabilities to limit the potential blast radius of similar vulnerabilities while the update is being staged.