CVE-2018-25370: Admidio CSRF Privilege Escalation Flaw

CVE-2018-25370 Overview

CVE-2018-25370 is a cross-site request forgery (CSRF) vulnerability in Admidio 3.3.5, an open-source membership management web application. The flaw resides in roles_function.php, which fails to validate request origins before processing role modification actions. Low-privilege authenticated users can be tricked into submitting attacker-crafted HTML forms that elevate the attacker's account permissions. Successful exploitation grants the attacker the ability to assign roles, approve users, and edit user accounts by setting parameters such as rol_assign_roles, rol_approve_users, and rol_edit_user to 1. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Attackers can escalate privileges in Admidio 3.3.5 by tricking authenticated administrators into loading a malicious page, gaining the ability to manage roles and modify user accounts.

Affected Products

Admidio 3.3.5
roles_function.php request handler
Membership and role management module

Discovery Timeline

2026-05-25 - CVE-2018-25370 published to the National Vulnerability Database (NVD)
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2018-25370

Vulnerability Analysis

The vulnerability stems from missing CSRF protection in the roles_function.php endpoint of Admidio 3.3.5. The application processes state-changing requests without verifying that the request originated from a legitimate user-driven action within the application. Admidio does not check anti-CSRF tokens, the Origin header, or the Referer header before applying role permission updates.

An attacker hosts a malicious page containing an auto-submitting HTML form targeting the vulnerable endpoint. When an authenticated Admidio administrator visits the page, the browser submits the forged request along with valid session cookies. The server processes the request as if it came from the administrator, applying the attacker-supplied role modifications.

The impact is privilege escalation within the Admidio application. By setting parameters such as rol_assign_roles=1, rol_approve_users=1, and rol_edit_user=1, an attacker can grant elevated permissions to a controlled low-privilege account [CWE-352].

Root Cause

The root cause is the absence of synchronizer tokens or equivalent origin-validation controls on the roles_function.php handler. State-changing operations rely solely on session cookies, which browsers attach automatically to cross-site requests.

Attack Vector

Exploitation requires an authenticated Admidio user with sufficient session validity to visit an attacker-controlled web page or follow a malicious link. No additional authentication on the attacker's part is required. See the Exploit-DB entry #45322 and the VulnCheck advisory for technical reproduction details.

No verified proof-of-concept code is reproduced here. Refer to the public advisories for the full HTML form payload structure.

Detection Methods for CVE-2018-25370

Indicators of Compromise

Unexpected changes to role permissions in the Admidio adm_roles database table, particularly increases to rol_assign_roles, rol_approve_users, or rol_edit_user flags.
HTTP POST requests to roles_function.php with a Referer header pointing to an external or unrelated domain.
Sudden privilege escalation events for accounts that did not perform administrative actions through the standard interface.

Detection Strategies

Inspect web server access logs for POST requests to roles_function.php and correlate the Referer and Origin headers against the Admidio host.
Audit application-level role change events and compare with the authenticated user's normal activity patterns.
Review database transaction logs for unauthorized modifications to role permission columns.

Monitoring Recommendations

Enable verbose HTTP request logging on the Admidio web server, including request headers and POST parameters where permitted by policy.
Implement alerts for any role permission elevation occurring outside expected administrative windows.
Monitor for anomalous session activity such as administrative actions immediately following navigation from external sites.

How to Mitigate CVE-2018-25370

Immediate Actions Required

Upgrade Admidio to a version newer than 3.3.5 that includes CSRF token validation on role management endpoints.
Audit all existing Admidio user accounts and reset any role permissions that cannot be attributed to legitimate administrative action.
Require administrators to log out of Admidio when not actively using the application to limit session reuse by forged requests.

Patch Information

Admidio addressed CSRF issues in releases after 3.3.5. Consult the Admidio official website and the Admidio 3.3.5 download page for version history, and apply the latest stable release. Review the VulnCheck advisory for vendor-confirmed remediation guidance.

Workarounds

Deploy a web application firewall (WAF) rule that rejects POST requests to roles_function.php when the Origin or Referer header does not match the Admidio application host.
Configure session cookies with the SameSite=Strict attribute to prevent browsers from attaching them to cross-site requests.
Restrict administrative access to Admidio through network controls or VPN to reduce the exposure of authenticated sessions to untrusted web content.

bash

# Example nginx configuration enforcing same-origin for state-changing requests
location ~ /roles_function\.php$ {
    if ($request_method = POST) {
        set $allowed_origin "0";
        if ($http_origin = "https://admidio.example.com") { set $allowed_origin "1"; }
        if ($http_referer ~* "^https://admidio\.example\.com/") { set $allowed_origin "1"; }
        if ($allowed_origin = "0") { return 403; }
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}