Improper Access Control in Admidio Allows Event Capacity Exhaustion

Executive Summary

Admidio before version 5.0.17 has an improper access control flaw. Authenticated members can bypass restrictions by submitting the additional_guests field in event registration, even when guest registration is disabled. This allows attackers to set additional_guests to the maximum available seats, filling event capacity and preventing other members from registering.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor event registration logs for excessive guest registrations by a single user. Check for events where additional_guests exceeds normal limits or where remaining seats drop to zero rapidly. Review modules/events/events_function.php for unauthorized modifications.

Useful 0 Not Useful 0

Impact Analysis

If you use Admidio for event management, attackers could block event registrations by exhausting available seats. This disrupts legitimate users from signing up for events, potentially causing inconvenience or loss of participation. The impact is limited to event capacity manipulation and does not directly expose sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly violate GDPR or HIPAA as it does not involve unauthorized data access or disclosure. However, if event management is part of a regulated system, blocking legitimate registrations could indirectly impact service availability, potentially affecting compliance with availability requirements in these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Admidio to version 5.0.17 or later. Implement input validation to restrict additional_guests to reasonable values. Review and restrict event registration permissions for authenticated members. Monitor event capacity and registration patterns for anomalies.

Useful 0 Not Useful 0