Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter
Date: 2026-03
Affected: composer/admidio/admidio
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-34383
CWE: CWE-20
CWE-352
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

## Summary The inventory module's `item_save` endpoint accepts a user-controllable POST parameter `imported` that, when set to `true`, completely bypasses both CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the `FormPresenter` validation normally enforces. ## Details In `modules/inventory.php`, the `imported` parameter is read from POST input: **File:** `modules/inventory.php:50` ```php $postImported = admFuncVariableIsValid($_POST, 'imported', 'bool', array('defaultValue' => false)); ``` This is then passed to `ItemService`: **File:** `modules/inventory.php:251-256` ```php $itemService = new ItemService($gDb, $itemUuid, $postCopyField, $postCopyNumber, $postImported); $itemService->save(true); ``` Inside `ItemService::save()`, the `postImported` flag completely skips CSRF and form validation: **File:** `src/Inventory/Service/ItemService.php:99-109` ```php public function save(bool $multiEdit = false): void { global $gCurrentSession, $gL10n, $gSettingsManager; // check form field input and sanitized it from malicious content if (!$this->postImported) { $itemFieldsEditForm = $gCurrentSession->getFormObject($_POST['adm_csrf_token']); $formValues = $itemFieldsEditForm->validate($_POST, $multiEdit); } else { $formValues = $_POST; // Raw $_POST used with no CSRF check,


Mitigations:

Architectural layers (MAESTRO):