A critical file upload vulnerability in Admidio allows authenticated users to execute arbitrary PHP scripts, potentially leading to a complete server compromise.

This vulnerability, categorized as CWE-434, stems from a design flaw in the interaction between CSRF token validation and file extension verification within UploadHandlerFile.php. An authenticated user with standard upload permissions can bypass security controls to upload malicious files, including PHP scripts, by submitting an invalid CSRF token.

The ability for an authenticated user to perform remote code execution poses a severe risk to the entire organization. Successful exploitation could result in full server control, the exfiltration of sensitive user management data, and the potential for lateral movement into internal network segments. With a CVSS score of 8.8, this vulnerability is classified as High and requires immediate attention to prevent unauthorized system access and data breaches.

Immediate Action: Update the Admidio installation to version 5.0.7 or later, which includes the necessary security patches to address the upload handler flaw.

Proactive Monitoring: Review web server and application access logs for unusual file upload activity or requests containing unexpected file extensions in the Documents and Files module.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to block the upload of executable scripts (e.g., .php files) and restrict access to the upload directory to authorized personnel only.

Public Exploit Available: Unknown.

Given the potential for remote code execution and the presence of a known proof-of-concept, organizations must prioritize the update to Admidio version 5.0.7. Failure to patch this vulnerability leaves the application and the underlying server infrastructure exposed to significant risk. Security teams should verify that all instances are updated and perform a thorough audit of the server to ensure no malicious files were uploaded prior to the application of the patch.