Admidio Ecard Message Allows Unfiltered HTML Injection

Summary

An attacker can inject malicious HTML and JavaScript into eCard emails sent to other members. This could lead to phishing or other types of attacks. To fix this, update the Admidio eCard send handler to use the properly sanitized eCard message value.

What to do

Update admidio admidio to version 5.0.7.

Affected software

Vendor	Product	Affected versions	Fix available
admidio	admidio	<= 5.0.6	5.0.7

Original title

Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $_POST['ecard_message'] value instead of the HTMLPurifier-sanitized $formValues['e...

Original description

Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $_POST['ecard_message'] value instead of the HTMLPurifier-sanitized $formValues['ecard_message'] when constructing the greeting card HTML. This allows an authenticated attacker to inject arbitrary HTML and JavaScript into greeting card emails sent to other members, bypassing the server-side HTMLPurifier sanitization that is properly applied to the ecard_message field during form validation. An attack can result in any member or role receiving phishing content that appears legitimate, crossing from the web application into recipients' email clients. This issue has been fixed in version 5.0.7.

ghsa CVSS3.1 5.4

Vulnerability type

CWE-79 Cross-site Scripting (XSS)