Unauthenticated Stored XSS in Admidio Registration

Executive Summary

Admidio 5.0.0 before 5.0.15 has an unauthenticated stored cross-site scripting (XSS) vulnerability in RegistrationPresenter.php. It allows attackers to register with a crafted FIRST_NAME value containing a double-quoted event handler that executes JavaScript when an administrator hovers over the entry on the Manage registrations page.

Useful 0 Not Useful 0

Detection Guidance

Check Admidio registration forms for suspicious input containing event handlers like onmouseover or onload in the FIRST_NAME field. Inspect the Manage registrations page HTML for unencoded data-message attributes with JavaScript payloads.

Useful 0 Not Useful 0

Impact Analysis

Attackers could steal session cookies, perform actions on behalf of administrators, or redirect users to malicious sites. Administrators viewing the registration list are the primary targets, as hovering triggers the payload.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) by enabling attackers to exfiltrate or manipulate protected information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Admidio to version 5.0.15 or later. Sanitize user input in registration forms to prevent XSS by encoding special characters in the FIRST_NAME field before database insertion.

Useful 0 Not Useful 0