GHSA-rw74-vc9h-534j
Suggest an improvement- Source
- https://github.com/advisories/GHSA-rw74-vc9h-534j
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-rw74-vc9h-534j/GHSA-rw74-vc9h-534j.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-rw74-vc9h-534j
- Aliases
- Published
- 2026-04-29T21:54:30Z
- Modified
- 2026-05-08T20:32:25Z
- Severity
-
- 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L CVSS Calculator
- Summary
- Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send
- Details
-
Summary
Several administrative operations in Admidio's preferences module (database backup, test email, htaccess generation) fire via GET requests with no CSRF token validation. Because
SameSite=Laxcookies travel with top-level GET navigations, an attacker forces an authenticated admin to trigger these actions from a malicious page.Details
In
modules/preferences.php, thebackup,test_email, andhtaccessmodes accept GET parameters with no CSRF token check:// modules/preferences.php - backup mode case 'backup': // Creates full database dump and serves as download // No CSRF token validation $backupFile = $gDb->backup(); // ... sends file to client break; case 'test_email': // Sends test email from the server // No CSRF token validation break; case 'htaccess': // Writes .htaccess file to disk // No CSRF token validation break;The
savemode in the same file validates CSRF viagetFormObject(), confirming the developers intended CSRF protection but did not apply it to these other modes.Because these are GET requests,
SameSite=Laxbrowsers include session cookies on top-level cross-origin navigations, making CSRF exploitation trivial.Proof of Concept
Simplified attacker page (
csrf.htmlhosted on attacker origin):<html> <body> <h1>Loading...</h1> <!-- Trigger backup creation on victim's browser --> <script>window.location = 'https://target-admidio.example.com/adm_program/modules/preferences.php?mode=backup';</script> </body> </html>When an administrator visits this page, the browser navigates to the Admidio backup URL with full session cookies. The server generates a database dump and serves it as a download to the victim's browser. Note: the backup downloads to the victim's machine, not to the attacker. The attacker cannot read the response cross-origin.
For
htaccessmode, the CSRF overwrites the.htaccessfile on the server, disrupting the application. Fortest_emailmode, it triggers email sends from the server, which an attacker can abuse for spam or to probe internal email infrastructure.Impact
An attacker tricks an Admidio administrator into visiting a malicious page that triggers state-changing operations on the server:
- Backup creation: forces the server to generate a full database dump. The backup downloads to the victim's browser, not to the attacker. However, repeated backup triggers can cause disk I/O and storage pressure on the server.
- htaccess modification: overwrites the server's
.htaccessfile, breaking URL routing or disabling security headers. - Test email: fires email sends from the server, usable as a spam relay or to probe internal mail configuration.
The core issue is that state-changing operations run via unprotected GET requests. The victim only needs to visit a single attacker-controlled page while logged in.
Recommended Fix
- Change
backup,test_email, andhtaccessoperations to require POST requests. - Add CSRF token validation using the existing
getFormObject()mechanism. - As defense in depth, set
SameSite=Stricton session cookies or add a confirmation step for destructive operations like database backup.
Found by aisafe.io
- Database specific
{ "cwe_ids": [ "CWE-352" ], "github_reviewed": true, "github_reviewed_at": "2026-04-29T21:54:30Z", "nvd_published_at": "2026-05-07T04:16:30Z", "severity": "LOW" }- References
Affected packages
Packagist / admidio/admidio
Package
- Name
- admidio/admidio
- Purl
- pkg:composer/admidio/admidio
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed5.0.9