CVE-2026-41663: Admidio/admidio Admidio Has CSRF On Admin Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rw74-vc9h-534j",
  "modified" : "2026-05-08T20:13:59Z",
  "published" : "2026-04-29T21:54:30Z",
  "aliases" : [ "CVE-2026-41663" ],
  "summary" : "Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send",
  "details" : "## Summary\n\nSeveral administrative operations in Admidio's preferences module (database backup, test email, htaccess generation) fire via GET requests with no CSRF token validation. Because `SameSite=Lax` cookies travel with top-level GET navigations, an attacker forces an authenticated admin to trigger these actions from a malicious page.\n\n## Details\n\nIn `modules/preferences.php`, the `backup`, `test_email`, and `htaccess` modes accept GET parameters with no CSRF token check:\n\n```php\n// modules/preferences.php - backup mode\ncase 'backup':\n    // Creates full database dump and serves as download\n    // No CSRF token validation\n    $backupFile = $gDb->backup();\n    // ... sends file to client\n    break;\n\ncase 'test_email':\n    // Sends test email from the server\n    // No CSRF token validation\n    break;\n\ncase 'htaccess':\n    // Writes .htaccess file to disk\n    // No CSRF token validation\n    break;\n```\n\nThe `save` mode in the same file validates CSRF via `getFormObject()`, confirming the developers intended CSRF protection but did not apply it to these other modes.\n\nBecause these are GET requests, `SameSite=Lax` browsers include session cookies on top-level cross-origin navigations, making CSRF exploitation trivial.\n\n## Proof of Concept\n\nSimplified attacker page (`csrf.html` hosted on attacker origin):\n\n```html\n<html>\n<body>\n<h1>Loading...</h1>\n<!-- Trigger backup creation on victim's browser -->\n<script>window.location = 'https://target-admidio.example.com/adm_program/modules/preferences.php?mode=backup';</script>\n</body>\n</html>\n```\n\nWhen an administrator visits this page, the browser navigates to the Admidio backup URL with full session cookies. The server generates a database dump and serves it as a download to the victim's browser. Note: the backup downloads to the victim's machine, not to the attacker. The attacker cannot read the response cross-origin.\n\nFor `htaccess` mode, the CSRF overwrites the `.htaccess` file on the server, disrupting the application. For `test_email` mode, it triggers email sends from the server, which an attacker can abuse for spam or to probe internal email infrastructure.\n\n## Impact\n\nAn attacker tricks an Admidio administrator into visiting a malicious page that triggers state-changing operations on the server:\n\n- **Backup creation**: forces the server to generate a full database dump. The backup downloads to the victim's browser, not to the attacker. However, repeated backup triggers can cause disk I/O and storage pressure on the server.\n- **htaccess modification**: overwrites the server's `.htaccess` file, breaking URL routing or disabling security headers.\n- **Test email**: fires email sends from the server, usable as a spam relay or to probe internal mail configuration.\n\nThe core issue is that state-changing operations run via unprotected GET requests. The victim only needs to visit a single attacker-controlled page while logged in.\n\n## Recommended Fix\n\n1. Change `backup`, `test_email`, and `htaccess` operations to require POST requests.\n2. Add CSRF token validation using the existing `getFormObject()` mechanism.\n3. As defense in depth, set `SameSite=Strict` on session cookies or add a confirmation step for destructive operations like database backup.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "admidio/admidio"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "5.0.9"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.0.8"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Admidio/admidio/security/advisories/GHSA-rw74-vc9h-534j"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-41663"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Admidio/admidio"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Admidio/admidio/releases/tag/v5.0.9"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-352" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-29T21:54:30Z",
    "nvd_published_at" : "2026-05-07T04:16:30Z"
  }
}