GitHub Security Advisory: GHSA-4wr4-f2qf-x5wj
Package: admidio/admidio (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 5.0.6
Patched in: 5.0.7

Summary: Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection

Details:
## Summary

The eCard send handler in Admidio uses the raw `$_POST['ecard_message']` value instead of the HTMLPurifier-sanitized `$formValues['ecard_message']` when constructing the greeting card HTML. This allows an authenticated attacker to inject arbitrary HTML and JavaScript into greeting card emails sent to other members, bypassing the server-side HTMLPurifier sanitization that is properly applied to the `ecard_message` field during form validation.

## Details

### Root Cause

File: `D:\bugcrowd\admidio\repo\modules\photos\ecard_send.php`

At line 38, the raw POST value is captured BEFORE form validation runs:

```php
$postMessage = $_POST['ecard_message'];  // Line 38: RAW value
```

At line 61, the form validation runs and properly sanitizes the message through HTMLPurifier (since ecard_message is registered as an editor field):

```php
$formValues = $photosEcardSendForm->validate($_POST);  // Line 61: sanitized
```

The sanitized value is stored in `$formValues['ecard_message']`, but this value is never used. Instead, the raw `$postMessage` is passed to `parseEcardTemplate()` at lines 159 and 201:

```php
$ecardHtmlData = $funcClass->parseEcardTemplate($imageUrl, $postMessage, ...);  // Line 159
$ecardHtmlData = $funcClass->parseEcardTemplate($imageUrl, $postMessage, ...);  // Line 201
```

### Template Injection

File: `D:\bugcrowd\admidio\repo\src\Photos\ValueObject\ECard.php`, line 144

The `parseEcardTemplate()` method places the message directly into the HTML template without any encoding:

```php
$pregRepArray['/<%ecard_message%>/'] = $ecardMessage;  // Line 144: no encoding
```

Compare this to the recipient fields which ARE properly encoded:

```php
$pregRepArray['/<%ecard_reciepient_email%>/'] = SecurityUtils::encodeHTML($recipientEmail);  // Line 135
$pregRepArray['/<%ecard_reciepient_name%>/']  = SecurityUtils::encodeHTML($recipientName);   // Line 136
```

### Inconsistency with Preview

File: `D:\bugcrowd\admidio\repo\modules\photos\ecard_preview.php`, line 56

The preview correctly uses the sanitized value:

```php
$smarty->assign('ecardContent', $funcClass->parseEcardTemplate($imageUrl, $formValues['ecard_message'], ...));
```

This means the preview shows the sanitized version, but the actual sent email contains the unsanitized content.

### Delivery Mechanism

The unsanitized HTML is delivered via two channels:

1. **HTML Email** (primary vector): At line 218 of `ECard.php`, the parsed template is set as the email body via `$email->setText($ecardHtmlData)` followed by `$email->setHtmlMail()`. The malicious HTML is rendered by the recipient's email client.

2. **Database Storage**: At line 214 of `ecard_send.php`, `$message->addContent($ecardHtmlData)` stores the raw HTML in the messages table. However, `MessageContent::getValue()` applies `SecurityUtils::encodeHTML()` on output, mitigating the stored XSS in the web interface.

## PoC

**Prerequisites:** Logged-in user with access to the photo module and eCard feature ena