Admidio versions from 5.0.0 up to but not including 5.0.16 contain an authorization bypass vulnerability. This flaw allows authenticated users with list view rights to export member lists as PDF files despite export restrictions. The issue arises because the groups_roles_export check in the relevant PHP module omits the 'pdfl' mode, which is used for PDF exports.
Admidio versions from 5.0.0 up to but not including 5.0.16 contain an insecure direct object reference (IDOR) vulnerability in the ForumService::saveTopic() function. This flaw allows authenticated users to modify forum topics belonging to other users by manipulating the topic_uuid parameter in their topic_save requests. Exploitation requires authentication and reuse of the attacker's own CSRF token to overwrite the victim's topic title and first post.
Admidio versions from 5.0.11 up to but not including 5.0.16 contain a broken access control vulnerability in the inventory module. This flaw allows any authenticated user to bypass the inventory_module_enabled restriction and access the DataTables JSON feed, exposing all inventory items and keeper names even when the module is disabled.
Admidio versions prior to 5.0.16 have an information disclosure vulnerability that allows unauthenticated attackers to access role-restricted weblinks. This occurs because the rss/links.php script does not apply the category_view role-visibility filter, exposing link names, URLs, descriptions, categories, and creator names from restricted link categories via the organization's RSS feed.
Admidio versions 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contain a reflected cross-site scripting (XSS) vulnerability in the system/redirect.php component. This vulnerability allows unauthenticated attackers to inject JavaScript code via the url GET parameter due to an incomplete fix of a previous vulnerability (CVE-2021-43810). The attack involves crafting a javascript: URL with a decoy http:// segment that bypasses validation and executes script in the context of the Admidio origin when a victim clicks the redirect link.
Admidio versions 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 have a broken access control vulnerability. This flaw allows role administrators to assign users to roles in organizations other than their own by submitting crafted requests with foreign role UUIDs. Exploiting this, attackers can gain privileged membership in other organizations, log in as those users, and modify user profiles.
Admidio versions 5.0.0 up to but not including 5.0.15 contain an unauthenticated stored cross-site scripting (XSS) vulnerability in the RegistrationPresenter.php component. This vulnerability occurs because the raw FIRST_NAME registration value is inserted into an unencoded data-message attribute. An attacker can exploit this by registering with a specially crafted input containing a double-quoted event handler, which executes JavaScript in an administrator's session when they hover over the entry on the Manage registrations page.
Admidio versions before 5.0.11 have an insecure direct object reference vulnerability in the save_temporary mode of mylist_function.php. Authenticated users can exploit this flaw to hijack list configurations by enumerating global list UUIDs and overwriting admin-curated global lists or other users' private lists. This allows attackers to transfer ownership and demote global lists to personal configurations. The vulnerability has a CVSS 3.1 score of 4.3, indicating medium severity.
Admidio versions before 5.0.11 contain a vulnerability in the modules/category-report/preferences.php file where the adm_csrf_token is not validated. This allows an attacker to trick an authenticated administrator into visiting a crafted URL that can delete or duplicate Category Report configurations. The flaw affects the integrity and availability of the Category Report module's configuration. The vulnerability has a CVSS 3.1 score of 4.6, indicating a medium severity impact primarily on integrity and availability with low attack complexity but requiring some user interaction and privileges.
Admidio versions before 5.0.11 have a reflected cross-site scripting (XSS) vulnerability in the SSO/SAML endpoint. This vulnerability occurs because unencoded exception messages are echoed in HTTP responses. Unauthenticated attackers can exploit this by injecting arbitrary JavaScript via SAML Issuer elements or LightSaml library parameters, potentially executing code in users' browsers and hijacking sessions.
Admidio versions prior to 5.0.11 contain a vulnerability where role handlers do not properly validate the target organization's membership. This flaw allows authenticated role administrators to manipulate roles of other organizations by supplying a role UUID from a different organization. Actions such as deleting, activating, deactivating, or editing roles can be performed without proper authorization. The vulnerability has a CVSS score of 4.9, indicating medium severity.
Admidio versions prior to 5.0.11 have an authentication bypass vulnerability in the forum module when it is configured in login-only mode. This flaw allows unauthenticated attackers to access forum topics and posts by exploiting improper access control checks in the module's code. The vulnerability does not affect the integrity or availability of the system but exposes confidential forum content to unauthorized users.