Executive Summary

This vulnerability exists in Admidio, an open-source user management solution, specifically in versions prior to 5.0.8. The issue is in the inventory module's item_save endpoint, which accepts a user-controllable POST parameter named 'imported'. When this parameter is set to true, it bypasses both CSRF token validation and server-side form validation.

As a result, an authenticated user can send a crafted POST request to save arbitrary inventory item data without the usual CSRF protection and without the normal validation checks on the form fields. This could allow manipulation of inventory data in ways that are normally prevented.

This vulnerability was fixed in version 5.0.8 of Admidio.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an authenticated user to bypass CSRF protection and server-side validation when saving inventory item data. This means that an attacker with valid credentials could manipulate inventory data arbitrarily, potentially leading to data integrity issues.

Since the vulnerability does not affect confidentiality or availability, but impacts integrity, it could result in incorrect or malicious data being stored in the inventory system, which may affect business operations relying on accurate inventory information.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Admidio to version 5.0.8 or later, where the issue has been patched.

Until the upgrade is applied, restrict authenticated user access to the inventory module's item_save endpoint to trusted users only, as the vulnerability allows bypassing CSRF and server-side validation.

Useful 0 Not Useful 0