CVE-2023-3303 (published 2023-06-23T13:15Z)

Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.

CVSS v3 base score: 3.5, LOW (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-284
cwe_name: Improper Access Control
description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
extended_description: 
            Access control involves the use of several protection mechanisms such as:
            
               Authentication (proving the identity of an actor)
               Authorization (ensuring that a given actor can access a resource), and
               Accountability (tracking of activities that were performed)
            
            When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
            There are two distinct behaviors that can introduce access control weaknesses:
               
                  Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
                  Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.
               
         
		 

Fix information:
repo_url: https://github.com/admidio/admidio
commit_details: repo_url: https://github.com/admidio/admidio
author: Markus Faßbender
author_date: 2023-06-08 07:21:41+02:00
msg: ecard could sent if album is logged #1432
repository: repo_url: https://github.com/admidio/admidio
repo_name: Admidio/admidio
description: Admidio is a free open source user management system for websites of organizations and groups. The system has a flexible role model so that it’s possible to reflect the structure and permissions of your organization.
repo_language: PHP
owner: admidio
file_changes: filename: ecard_send.php
change_type: ModificationType.MODIFY
diff: @@ -11,6 +11,12 @@
 require_once(__DIR__ . '/../../system/common.php');
 require_once(__DIR__ . '/ecard_function.php');
 
+// check if the module is enabled and disallow access if it's disabled
+if (!$gSettingsManager->getBool('enable_ecard_module')) {
+    $gMessage->show($gL10n->get('SYS_MODULE_DISABLED'));
+    // => EXIT
+}
+
 // Initialize and check the parameters
 $postTemplateName = admFuncVariableIsValid($_POST, 'ecard_template', 'file', array('requireValue' => true));
 $postPhotoUuid    = admFuncVariableIsValid($_POST, 'photo_uuid', 'string', array('requireValue' => true));
@@ -33,14 +39,15 @@ try {
     // => EXIT
 }
 
-// check if the module is enabled and disallow access if it's disabled
-if (!$gSettingsManager->getBool('enable_ecard_module')) {
-    $gMessage->show($gL10n->get('SYS_MODULE_DISABLED'));
+// check if user has right to view the album
+if (!$photoAlbum->isVisible()) {
+    $gMessage->show($gL10n->get('SYS_INVALID_PAGE_VIEW'));
     // => EXIT
 }
-// pruefen ob User eingeloggt ist
-if (!$gValidLogin) {
-    $gMessage->show($gL10n->get('SYS_INVALID_PAGE_VIEW'));
+
+// the logged-in user has no valid mail address stored in his profile, which can be used as sender
+if ($gValidLogin && $gCurrentUser->getValue('EMAIL') === '') {
+    $gMessage->show($gL10n->get('SYS_CURRENT_USER_NO_EMAIL', array('<a href="'.ADMIDIO_URL.FOLDER_MODULES.'/profile/profile.php">', '</a>')));
     // => EXIT
 }
 
@@ -58,7 +65,7 @@ if ($postMessage === '') {
     // => EXIT
 }
 
-// Template wird geholt
+// read template from file system
 $ecardDataToParse = $funcClass->getEcardTemplate($postTemplateName);
 
 // if template was not found then show error

programming_language: PHP
filename: ecards.php
change_type: ModificationType.MODIFY
diff: @@ -19,7 +19,7 @@ require_once(__DIR__ . '/ecard_function.php');
 require(__DIR__ . '/../../system/login_valid.php');
 
 // Initialize and check the parameters
-$getPhotoUuid = admFuncVariableIsValid($_GET, 'photo_uuid', 'string');
+$getPhotoUuid = admFuncVariableIsValid($_GET, 'photo_uuid', 'string', array('requireValue' => true));
 $getUserUuid  = admFuncVariableIsValid($_GET, 'user_uuid', 'string');
 $getPhotoNr   = admFuncVariableIsValid($_GET, 'photo_nr', 'int', array('requireValue' => true));
 $showPage     = admFuncVariableIsValid($_GET, 'show_page', 'int', array('defaultValue' => 1));
@@ -35,47 +35,43 @@ if (!$gSettingsManager->getBool('enable_ecard_module')) {
     // => EXIT
 }
 
-// URL auf Navigationstack ablegen
+// Drop URL on navigation stack
 $gNavigation->addUrl(CURRENT_URL, $headline);
 
-// Fotoveranstaltungs-Objekt erzeugen oder aus Session lesen
+// Create photo album object or read from session
 if (isset($_SESSION['photo_album']) && (int) $_SESSION['photo_album']->getValue('pho_uuid') === $getPhotoUuid) {
     $photoAlbum =& $_SESSION['photo_album'];
 } else {
-    // einlesen des Albums falls noch nicht in Session gespeichert
     $photoAlbum = new TablePhotos($gDb);
-    if ($getPhotoUuid !== '') {
-        $photoAlbum->readDataByUuid($getPhotoUuid);
-    }
+    $photoAlbum->readDataByUuid($getPhotoUuid);
 
     $_SESSION['photo_album'] = $photoAlbum;
 }
 
-// pruefen, ob Album zur aktuellen Organisation gehoert
-if ($getPhotoUuid !== '' && (int) $photoAlbum->getValue('pho_org_id') !== $gCurrentOrgId) {
+// check if user has right to view the album
+if (!$photoAlbum->isVisible()) {
     $gMessage->show($gL10n->get('SYS_INVALID_PAGE_VIEW'));
     // => EXIT
 }
 
 if ($gValidLogin && $gCurrentUser->getValue('EMAIL') === '') {
-    // der eingeloggte Benutzer hat in seinem Profil keine gueltige Mailadresse hinterlegt,
-    // die als Absender genutzt werden kann...
+    // the logged in user has no valid mail address stored in his profile, which can be used as sender
     $gMessage->show($gL10n->get('SYS_CURRENT_USER_NO_EMAIL', array('<a href="'.ADMIDIO_URL.FOLDER_MODULES.'/profile/profile.php">', '</a>')));
     // => EXIT
 }
 
 if ($getUserUuid !== '') {
-    // usr_id wurde uebergeben, dann Kontaktdaten des Users aus der DB fischen
+    // UUID was set than read contact data of this user
     $user = new User($gDb, $gProfileFields);
     $user->readDataByUuid($getUserUuid);
 
-    // darf auf die User-Id zugegriffen werden
+    // check if the current user has the right communicate with that member
     if ((!$gCurrentUser->editUsers() && !isMember((int) $user->getValue('usr_id'))) || strlen($user->getValue('usr_id')) === 0) {
         $gMessage->show($gL10n->get('SYS_USER_ID_NOT_FOUND'));
         // => EXIT
     }
 
-    // besitzt der User eine gueltige E-Mail-Adresse
+    // check if the member has a valid email address
     if (!StringUtils::strValidCharacters($user->getValue('EMAIL'), 'email')) {
         $gMessage->show($gL10n->get('SYS_USER_NO_EMAIL', array($user->getValue('FIRST_NAME').' '.$user->getValue('LAST_NAME'))));
         // => EXIT

programming_language: PHP
filename: photos.php
change_type: ModificationType.MODIFY
diff: @@ -59,7 +59,7 @@ if ($getPhotoUuid !== '') {
 
     $headline = $photoAlbum->getValue('pho_name');
 
-    // URL auf Navigationstack ablegen
+    // Drop URL on navigation stack
     $gNavigation->addUrl(CURRENT_URL, $headline);
 } else {
     $headline = $getHeadline;

programming_language: PHP
filename: TablePhotos.php
change_type: ModificationType.MODIFY
diff: @@ -232,7 +232,7 @@ class TablePhotos extends TableAccess
             return false;
         }
         // locked photo album could only be viewed by module administrators
-        elseif ((int) $this->getValue('pho_locked') === 1 && !$GLOBALS['gCurrentUser']->editPhotoRight()) {
+        elseif ($this->getValue('pho_locked') && !$GLOBALS['gCurrentUser']->editPhotoRight()) {
             return false;
         }
 

programming_language: PHP