CVE-2024-38529

CVE-2024-38529 is a Remote Code Execution (RCE) vulnerability affecting Admidio, an open-source user management system, in versions prior to 4.3.10. This flaw allows authenticated attackers to upload malicious PHP files via the Message module due to insufficient file extension verification. The uploaded files are publicly accessible, enabling RCE. Rated 8.8 HIGH on CVSS, this vulnerability has a low attack complexity and requires only low privileges, posing a significant risk of complete compromise (confidentiality, integrity, and availability). While the EPSS score is low, indicating a lower probability of exploitation compared to many CVEs, the FAUCET Risk Score is high at 82/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for a large percentage of reported vulnerabilities.