Admidio is Missing CSRF Protection on Role Membership Date Changes

Vulnerability

Description Admidio versions 5.0.6 and below contain a Cross-Site Request Forgery (CSRF) vulnerability in the save_membership action of modules/profile/profile_function.php. The code validates CSRF tokens for stop_membership and remove_former_membership but omits this check for save_membership, allowing an attacker to force a victim's browser to submit unauthorized membership date changes [1][2].

Attack

Vector An attacker can embed a crafted HTML form on any external website that automatically submits POST data to the vulnerable Admidio endpoint. The form requires valid membership UUIDs, which are visible in the page source to authenticated users. The attacker tricks a role leader into submitting the form, for example via a phishing link or malicious ad, exploiting the victim's active session [2].

Impact

By altering membership start and end dates, an attacker can effectively terminate a user's access by backdating, covertly extend unauthorized access, or revoke role-restricted features. These changes occur silently without confirmation, notification, or administrative approval, potentially leading to privilege escalation or denial of service [1].

Mitigation

The issue has been fixed in Admidio version 5.0.7 [4]. Users should upgrade immediately to prevent exploitation. No workaround is available for earlier versions.