Executive Summary

This vulnerability exists in Admidio versions 5.0.6 and below, specifically in the save_membership action within the modules/profile/profile_function.php file. The action saves changes to a member's role membership start and end dates but fails to validate the CSRF (Cross-Site Request Forgery) token.

While other actions like stop_membership and remove_former_membership check the CSRF token, save_membership does not. Because membership UUIDs are visible in the HTML source to authenticated users, an attacker can craft a malicious POST form on an external page and trick a role leader into submitting it.

This allows the attacker to silently alter membership dates for any member of roles the victim leads without confirmation, notification, or administrative approval.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to exploit a role leader's session via CSRF to manipulate membership dates of any member within roles the victim leads.

• Terminate access by backdating membership end dates.
• Covertly extend unauthorized access by backdating membership start dates.
• Revoke role-restricted features without any confirmation or notification.

All these actions can be done silently, potentially disrupting user access and role management without administrative oversight.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Admidio to version 5.0.7 or later, where the issue has been fixed.

Until the upgrade can be applied, restrict role leaders' access or monitor for suspicious changes to membership dates, as the vulnerability allows CSRF attacks to silently alter membership roles.

Useful 0 Not Useful 0