CVE-2023-3303 (PHP, published 2023-06-23T13:15Z)
Description: value: Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
Severity: nan (CVSS v3 base score: 3.5)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/admidio/admidio
Files changed:
adm_program/modules/ecards/ecard_send.php
adm_program/modules/ecards/ecards.php
adm_program/modules/photos/photos.php
adm_program/system/classes/TablePhotos.php
Commit message: ecard could sent if album is logged #1432


Vulnerable code:
// check if the module is enabled and disallow access if it's disabled
if (!$gSettingsManager->getBool('enable_ecard_module')) {
    $gMessage->show($gL10n->get('SYS_MODULE_DISABLED'));
// pruefen ob User eingeloggt ist
if (!$gValidLogin) {
    $gMessage->show($gL10n->get('SYS_INVALID_PAGE_VIEW'));
// Template wird geholt
$getPhotoUuid = admFuncVariableIsValid($_GET, 'photo_uuid', 'string');
// URL auf Navigationstack ablegen
// Fotoveranstaltungs-Objekt erzeugen oder aus Session lesen
    // einlesen des Albums falls noch nicht in Session gespeichert
    if ($getPhotoUuid !== '') {
        $photoAlbum->readDataByUuid($getPhotoUuid);
    }
// pruefen, ob Album zur aktuellen Organisation gehoert
if ($getPhotoUuid !== '' && (int) $photoAlbum->getValue('pho_org_id') !== $gCurrentOrgId) {
    // der eingeloggte Benutzer hat in seinem Profil keine gueltige Mailadresse hinterlegt,
    // die als Absender genutzt werden kann...
    // usr_id wurde uebergeben, dann Kontaktdaten des Users aus der DB fischen
    // darf auf die User-Id zugegriffen werden
    // besitzt der User eine gueltige E-Mail-Adresse
    // URL auf Navigationstack ablegen
        elseif ((int) $this->getValue('pho_locked') === 1 && !$GLOBALS['gCurrentUser']->editPhotoRight()) {

Fixed code:
// check if the module is enabled and disallow access if it's disabled
if (!$gSettingsManager->getBool('enable_ecard_module')) {
    $gMessage->show($gL10n->get('SYS_MODULE_DISABLED'));
    // => EXIT
}

// check if user has right to view the album
if (!$photoAlbum->isVisible()) {
    $gMessage->show($gL10n->get('SYS_INVALID_PAGE_VIEW'));

// the logged-in user has no valid mail address stored in his profile, which can be used as sender
if ($gValidLogin && $gCurrentUser->getValue('EMAIL') === '') {
    $gMessage->show($gL10n->get('SYS_CURRENT_USER_NO_EMAIL', array('<a href="'.ADMIDIO_URL.FOLDER_MODULES.'/profile/profile.php">', '</a>')));
// read template from file system
$getPhotoUuid = admFuncVariableIsValid($_GET, 'photo_uuid', 'string', array('requireValue' => true));
// Drop URL on navigation stack
// Create photo album object or read from session
    $photoAlbum->readDataByUuid($getPhotoUuid);
// check if user has right to view the album
if (!$photoAlbum->isVisible()) {
    // the logged in user has no valid mail address stored in his profile, which can be used as sender
    // UUID was set than read contact data of this user
    // check if the current user has the right communicate with that member
    // check if the member has a valid email address
    // Drop URL on navigation stack
        elseif ($this->getValue('pho_locked') && !$GLOBALS['gCurrentUser']->editPhotoRight()) {