CVE-2017-6492 Admidio CVE debrief

Who should care

Administrators and security teams responsible for Admidio deployments, especially instances running version 3.2.5 or code derived from the affected module. Because the NVD vector includes PR:H, the main concern is abuse by a user with elevated application privileges rather than an unauthenticated attacker.

Technical summary

According to the CVE description, adm_program/modules/dates/dates_function.php in Admidio 3.2.5 concatenates the POST parameter dat_cat_id into a SQL query without validation or sanitization. NVD classifies the weakness as CWE-89 (SQL Injection) and assigns CVSS 3.0 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating network reachability but requiring high privileges. The vulnerable CPE entry explicitly marks cpe:2.3:a:admidio:admidio:3.2.5 as affected.

Defensive priority

High. The score is in the high range, and the impact can include confidentiality, integrity, and availability loss. At the same time, the PR:H requirement means exposure is most concerning where privileged Admidio accounts exist or where privilege boundaries are weak.

Recommended defensive actions

• Confirm whether any vendor update or downstream package release addresses CVE-2017-6492, and deploy it if available.
• Restrict access to the affected Admidio functions to least-privileged, trusted accounts only.
• Review the affected code path for parameterized queries and server-side validation of dat_cat_id and related inputs.
• Monitor application and database logs for unusual SQL patterns or unexpected activity around the dates module.
• If abuse is suspected, rotate affected credentials and validate database integrity and account permissions.

Evidence notes

The supplied corpus is consistent across the CVE description and NVD metadata: the vulnerable component is Admidio 3.2.5, the flaw is SQL injection in adm_program/modules/dates/dates_function.php, and the POST parameter dat_cat_id is concatenated into a SQL query without validation/sanitization. NVD also provides the CVSS 3.0 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H and CWE-89 classification. Reference metadata includes a SecurityFocus BID entry and a third-party GitHub advisory/exploit repository; those are noted for corroboration only.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.