SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• admidio admidio3.2.5

Other highest-scoring records for the same primary product.

• CVE-2026-32817Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
  36Monitor
• CVE-2026-32756Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module
  35Monitor
• CVE-2024-38529Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
  35Monitor
• CVE-2024-37906Admidio has Blind SQL Injection in ecard_send.php
  35Monitor
• CVE-2021-32630Admidio is a free, open source user management system for websites of organizations and groups.
  35Monitor
• CVE-2026-82657Admidio before 5.0.12 Authentication Bypass via RSS feeds
  34Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = '" + owner + "'"4);

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = $1",4  [owner]5);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.