CyberRota Analysis
AI-GeneratedAdmidio versions prior to 5.0.10 are vulnerable due to a lack of CSRF validation in the `mode=export` action, allowing unauthorized export of sensitive PKCS#12 bundles containing private keys and certificates via forged cross-site POST requests. This vulnerability poses a medium risk, as it could lead to unauthorized access to sensitive cryptographic materials. Organizations using Admidio for user management should prioritize upgrading to version 5.0.10 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an administrator session can therefore trigger private key export without a valid form token. Version 5.0.10 contains a fix.