Description

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an authenticated administrator visits it, triggers arbitrary plugin operations. The uninstall operation executes DROP TABLE SQL scripts and destroys plugin data. This issue has been patched via commit 056b1bd.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.2",
  "pubDate": "2026-09-04T18:17:52.770Z",
  "pubdate": "2026-09-04T18:17:52.770Z",
  "executiveSummary": "Admidio versions 5.0.11 and prior are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability located within the modules/plugins.php component.\nThe vulnerability allows an unauthenticated remote attacker to perform unauthorized administrative actions, including the installation, uninstallation, and update of system plugins.\nBecause the application utilizes GET requests for state-changing operations, browsers automatically attach SameSite=Lax session cookies during top-level navigations, enabling the exploitation of an authenticated administrator's session.\nThe impact is significant, as the arbitrary execution of plugin uninstallation routines can trigger destructive database operations, such as DROP TABLE SQL commands, leading to total data loss and service disruption.\nExploitation requires an authenticated administrator to visit a malicious, attacker-controlled webpage while their session is active.\nThis vulnerability highlights a critical flaw in session security and input validation practices regarding administrative control modules.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of security controls for state-changing administrative actions within the modules/plugins.php script. The application relies on GET requests to perform sensitive operations related to plugin lifecycle management (installation, uninstallation, and updates) without requiring cryptographically secure, unpredictable anti-CSRF tokens.\nIn web environments, browsers maintain session persistence via cookies. By default, even with SameSite=Lax cookie policies, these cookies are automatically included in top-level GET navigations. The vulnerability exists because the modules/plugins.php endpoint fails to distinguish between legitimate user-initiated requests and malicious requests initiated by third-party origins.\nThe attack flow begins when an attacker hosts a malicious website containing a hidden trigger, such as a crafted link or an automated redirect targeting the Admidio instance. When an authenticated administrator visits the attacker's site, the browser sends an HTTP GET request to the modules/plugins.php endpoint with the necessary parameters for an action (e.g., uninstall).\nBecause the request originates from the administrator's browser, it carries the required session authentication cookies. The server processes the request as if the administrator had manually navigated to the URL, resulting in the successful execution of the requested operation.\nThe technical impact of this flaw is particularly severe due to the design of the plugin system. The uninstallation routine within Admidio is programmed to execute SQL scripts, specifically DROP TABLE commands, to remove plugin-related schema from the backend database. Consequently, an attacker can induce irreversible data loss by forcing the uninstallation of installed plugins, effectively wiping module-specific data without administrative consent.\nThis vulnerability affects Admidio versions 5.0.11 and prior. It bypasses conventional browser security boundaries by exploiting the trust relationship between the user's session and the administrative interface. The flaw persists until the application is updated to a version containing the fix identified in commit 056b1bd, which likely introduces per-request CSRF validation tokens to ensure that only requests originating from the legitimate administrative dashboard are processed."
}