CVE-2018-25370 — Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php
Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their permissions by exploiting improper origin checking. Attackers…
Published: 2026-05-25 · CVSS: 6.9 · CVSS 4.0
Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their permissions by exploiting improper origin checking. Attackers can craft malicious HTML forms targeting roles_function.php with parameters like rol_assign_roles, rol_approve_users, and rol_edit_user set to 1 to escalate privileges without authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7