{"id":"CVE-2026-41663","aliases":["GHSA-rw74-vc9h-534j"],"url":"https://o3.security/vulnerability/CVE-2026-41663","summary":"Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send","details":"## Summary\n\nSeveral administrative operations in Admidio's preferences module (database backup, test email, htaccess generation) fire via GET requests with no CSRF token validation. Because `SameSite=Lax` cookies travel with top-level GET navigations, an attacker forces an authenticated admin to trigger these actions from a malicious page.\n\n## Details\n\nIn `modules/preferences.php`, the `backup`, `test_email`, and `htaccess` modes accept GET parameters with no CSRF token check:\n\n```php\n// modules/preferences.php - backup mode\ncase 'backup':\n // Creates full database dump and serves as download\n // No CSRF token validation\n $backupFile = $gDb->backup();\n // ... sends file to client\n break;\n\ncase 'test_email':\n // Sends test email from the server\n // No CSRF token validation\n break;\n\ncase 'htaccess':\n // Writes .htaccess file to disk\n // No CSRF token validation\n break;\n```\n\nThe `save` mode in the same file validates CSRF via `getFormObject()`, confirming the developers intended CSRF protection but did not apply it to these other modes.\n\nBecause these are GET requests, `SameSite=Lax` browsers include session cookies on top-level cross-origin navigations, making CSRF exploitation trivial.\n\n## Proof of Concept\n\nSimplified attacker page (`csrf.html` hosted on attacker origin):\n\n```html\n\n\nLoading...
\n\n\n\n\n```\n\nWhen an administrator visits this page, the browser navigates to the Admidio backup URL with full session cookies. The server generates a database dump and serves it as a download to the victim's browser. Note: the backup downloads to the victim's machine, not to the attacker. The attacker cannot read the response cross-origin.\n\nFor `htaccess` mode, the CSRF overwrites the `.htaccess` file on the server, disrupting the application. For `test_email` mode, it triggers email sends from the server, which an attacker can abuse for spam or to probe internal email infrastructure.\n\n## Impact\n\nAn attacker tricks an Admidio administrator into visiting a malicious page that triggers state-changing operations on the server:\n\n- **Backup creation**: forces the server to generate a full database dump. The backup downloads to the victim's browser, not to the attacker. However, repeated backup triggers can cause disk I/O and storage pressure on the server.\n- **htaccess modification**: overwrites the server's `.htaccess` file, breaking URL routing or disabling security headers.\n- **Test email**: fires email sends from the server, usable as a spam relay or to probe internal mail configuration.\n\nThe core issue is that state-changing operations run via unprotected GET requests. The victim only needs to visit a single attacker-controlled page while logged in.\n\n## Recommended Fix\n\n1. Change `backup`, `test_email`, and `htaccess` operations to require POST requests.\n2. Add CSRF token validation using the existing `getFormObject()` mechanism.\n3. As defense in depth, set `SameSite=Strict` on session cookies or add a confirmation step for destructive operations like database backup.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*","published":"2026-05-07T03:00:11.696Z","modified":"2026-08-12T03:51:39.377623890Z","cvss":{"score":3.5,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"},"epss":{"score":0.00117,"percentile":0.01918,"asOf":"2026-08-13"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"admidio/admidio","fixedVersion":"5.0.9"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/Admidio/admidio/releases/tag/v5.0.9"},{"type":"ADVISORY","url":"https://github.com/Admidio/admidio/security/advisories/GHSA-rw74-vc9h-534j"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41663.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41663"},{"type":"PACKAGE","url":"https://github.com/Admidio/admidio"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:39.377623890Z"}}