Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
The advisory, in context
Vulnerability
In modules/events/events_function.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the user_uuid GET parameter.
Line 47: $getUserUuid = admFuncVariableIsValid($_GET, 'user_uuid', 'uuid', ...)
Line 424: if ($event->possibleToParticipate() || $participants->isLeader($gCurrentUserId))
The condition uses || (OR), meaning if possibleToParticipate() returns true (event is open for participation), ANY user - not just leaders - can specify a different user_uuid and register/cancel participation for that user.
The code then operates on $user->getValue('usr_id') (the target user from user_uuid) rather than the current user.
Impact
- Register unwilling users for events (potential harassment/spam)
- Cancel other users' event participation
- Manipulate event participant counts and comments
- If events have participation limits, fill slots with unwanted registrations
Fix
For non-leader users, force user_uuid to the current user:
if (!$participants->isLeader($gCurrentUserId)) {
$getUserUuid = $gCurrentUser->getValue('usr_uuid');
}
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 5.0.6
Fixed in 5.0.6
51 explicitly affected versions
4.1.0, 4.1.3, v4.2-Beta.1, v4.2-Beta.2, v4.2-Beta.3, v4.2.0, v4.2.1, v4.2.10, v4.2.11, v4.2.12, v4.2.13, v4.2.14, v4.2.2, v4.2.3, v4.2.4, v4.2.5, v4.2.6, v4.2.7, v4.2.8, v4.2.9, v4.3-Beta.1, v4.3-Beta.3, v4.3-Beta.4, v4.3-Beta.5, v4.3.0, v4.3.1, v4.3.10, v4.3.11, v4.3.12, v4.3.13, v4.3.14, v4.3.15, v4.3.16, v4.3.17, v4.3.2, v4.3.3, v4.3.4, v4.3.5, v4.3.6, v4.3.7, v4.3.8, v4.3.9, v5.0-Beta.1, v5.0-Beta.2, v5.0-Beta.3, v5.0.0, v5.0.1, v5.0.2, v5.0.3, v5.0.4, v5.0.5
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.1.0",
"4.1.3",
"v4.2-Beta.1",
"v4.2-Beta.2",
"v4.2-Beta.3",
"v4.2.0",
"v4.2.1",
"v4.2.10",
"v4.2.11",
"v4.2.12",
"v4.2.13",
"v4.2.14",
"v4.2.2",
"v4.2.3",
"v4.2.4",
"v4.2.5",
"v4.2.6",
"v4.2.7",
"v4.2.8",
"v4.2.9",
"v4.3-Beta.1",
"v4.3-Beta.3",
"v4.3-Beta.4",
"v4.3-Beta.5",
"v4.3.0",
"v4.3.1",
"v4.3.10",
"v4.3.11",
"v4.3.12",
"v4.3.13",
"v4.3.14",
"v4.3.15",
"v4.3.16",
"v4.3.17",
"v4.3.2",
"v4.3.3",
"v4.3.4",
"v4.3.5",
"v4.3.6",
"v4.3.7",
"v4.3.8",
"v4.3.9",
"v5.0-Beta.1",
"v5.0-Beta.2",
"v5.0-Beta.3",
"v5.0.0",
"v5.0.1",
"v5.0.2",
"v5.0.3",
"v5.0.4",
"v5.0.5"
]
}