CVE-2023-3692: Admidio vulnerable to Unrestricted Upload of File with Dangerous Type
6.7
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.16375%
CWE
Published
7/16/2023
Updated
11/6/2023
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| admidio/admidio | composer | < 4.2.10 | 4.2.10 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability existed in the CKEditor file upload handler logic. Prior to the patch, the code:
- Moved uploaded files via move_uploaded_file() without first validating the file extension
- Only performed a weak validation via getimagesize() after the file was already stored
This allowed two attack vectors:
- Uploading non-image files with dangerous extensions
- Uploading polyglot files that pass getimagesize() checks but contain executable code
The patch added a critical FileSystemUtils::allowedFileExtension() check early in the process to validate extensions before any file operations. The vulnerable code path in ckeditor_upload_handler.php's main execution flow (not wrapped in a named function) was directly responsible for the insecure upload mechanism.