CVE-2026-109328 in Admidio
Summary
by MITRE • 10/12/2026
Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRST_NAME registration value into an unencoded data-message attribute. Attackers can register with a double-quoted event handler that executes JavaScript in an administrator's session when they hover the entry on the Manage registrations page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The identified vulnerability resides within Admidio versions prior to 5.0.15, specifically affecting the RegistrationPresenter.php component. This flaw constitutes an unauthenticated stored cross-site scripting (XSS) issue that stems from a failure to properly sanitize user-supplied input before rendering it in a web page context. The core technical deficiency lies in how the system handles the FIRST_NAME field during the registration process. Instead of encoding or escaping special characters, the application directly inserts the raw value provided by the attacker into an unencoded data-message attribute within the HTML structure generated for administrative interfaces. This lack of output encoding allows malicious scripts to be persisted on the server side rather than being executed transiently in a single request, thereby increasing the potential blast radius and persistence of the attack.
From an operational perspective, this vulnerability enables remote attackers who do not require valid credentials to inject executable JavaScript code into the application's database or storage mechanism. The payload is triggered when an administrator accesses the Manage registrations page and hovers over the malicious entry. This interaction causes the browser to interpret the injected script within the context of the administrator's active session. Because the execution occurs in the privileged administrative interface, the impact extends beyond simple defacement or data theft from a standard user account. The attacker can potentially hijack the administrator's session cookie, perform actions on behalf of the admin such as modifying system configurations, creating new accounts with elevated privileges, or exfiltrating sensitive organizational data stored within the Admidio platform. This represents a significant compromise to both confidentiality and integrity.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. Specifically, it falls under the sub-category of Stored XSS where malicious scripts are permanently stored in target servers. Furthermore, from a tactical standpoint related to the MITRE ATT&CK framework, this exploit maps to T1059 Command and Control via Application Layer Protocol or more specifically techniques involving Web Session Hijacking if session tokens are stolen, and potentially T1136 Create Account for persistence depending on what actions the attacker performs post-exploitation. The unauthenticated nature of the initial vector also highlights a failure in input validation principles that should be enforced at multiple layers including presentation logic and data handling components.
To mitigate this vulnerability, immediate patching to Admidio version 5.0.15 or later is required as it addresses the encoding issues within RegistrationPresenter.php. In environments where upgrading is not immediately feasible, administrators can implement a web application firewall rule that detects and blocks common XSS payloads in registration form submissions, particularly targeting the FIRST_NAME field for characters such as double quotes, angle brackets, and event handler keywords like onmouseover or onclick. Additionally, enforcing strict Content Security Policy headers with nonces or hashes can prevent the execution of any injected scripts even if they are successfully stored. Regular security audits focusing on output encoding practices across all user input fields are recommended to prevent similar flaws in other modules of the application.