Executive brief
Adianti Framework, a PHP-based tool for building business applications, contains a security flaw in its user profile management component. An authenticated user can submit specially crafted text in the profile name field to manipulate the underlying database. This allows a standard user to change other users' credentials, potentially taking over administrative accounts and gaining full control over the application and its data.
Technical details
An SQL injection vulnerability exists in Adianti Framework versions 5.5.0 and 5.6.0 within the SystemProfileForm component. The vulnerability is rooted in the improper neutralization of the 'name' field during a profile update (onEdit method). An authenticated attacker with low-level privileges can inject SQL commands into the profile edit endpoint to bypass intended query logic. By crafting a specific payload, an attacker can execute an UPDATE statement that modifies the credentials (login, password, and email) of other users, including the administrator (ID 1), leading to full account takeover. This is reachable via a network request to the profile edit URL.
Affected products
- Adianti Adianti Framework 5.5.0, 5.6.0
Timeline
- 2018-12-18: other: Vulnerability discovered by researcher
- 2019-01-21: disclosed: Exploit published on Exploit-DB
- 2026-04-12: advisory: CVE published/updated by VulnCheck/NVD