Quick answers
- Is CVE-2018-25370 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2018-25370 being exploited in the wild.
- How severe is CVE-2018-25370?
- Medium severity, with a CVSS score of 5.3, published 25 May 2026.
- Which products and versions are affected?
- Admidio 3.3.5 and earlier.
- Is there a fix for CVE-2018-25370?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2018-25370 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2018-25370?
- Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Admidio 3.3.5 due to improper origin checking in the roles_function.php component. An attacker can exploit this by crafting a malicious HTML form that targets the application's role management parameters, such as rol_assign_roles, rol_approve_users, and rol_edit_user. By setting these parameters to 1, a low-privileged user can escalate their own privileges or modify role permissions. The attack requires the victim to be authenticated and interact with a malicious page, though the advisory suggests it can lead to privilege escalation without further authentication once the request is processed. A proof-of-concept exploit is publicly available.
Affected products
- Admidio Admidio 3.3.5 and earlier
Timeline
- 2018-09-01: disclosed: Initial discovery and exploit development by researcher
- 2018-09-03: other: Exploit published on Exploit-DB
- 2026-05-25: advisory: CVE published/updated via VulnCheck and NVD