Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $_POST['ecard_message'] value instead of the HTMLPurifier-sanitized $formValues['ecard_message'] when constructing the greeting card HTML. This allows an authenticated attacker to inject arbitrary HTML and JavaScript into greeting card emails sent to other members, bypassing the server-side HTMLPurifier sanitization that is properly applied to the ecard_message field during form validation. An attack can result in any member or role receiving phishing content that appears legitimate, crossing from the web application into recipients' email clients. This issue has been fixed in version 5.0.7.

Affected: Packagist: admidio/admidio

## Summary

The eCard send handler in Admidio uses the raw `$_POST['ecard_message']` value instead of the HTMLPurifier-sanitized `$formValues['ecard_message']` when constructing the greeting card HTML. This allows an authenticated attacker to inject arbitrary HTML and JavaScript into greeting card emails sent to other members, bypassing the server-side HTMLPurifier sanitization that is properly applied to the `ecard_message` field during form validation.

## Details

### Root Cause

File: `D:\bugcrowd\admidio\repo\modules\photos\ecard_send.php`

At line 38, the raw POST value is captured BEFORE form validation runs:

```php $postMessage = $_POST['ecard_message']; // Line 38: RAW value ```

At line 61, the form validation runs and properly sanitizes the message through HTMLPurifier (since ecard_message is registered as an editor field):

```php $formValues = $photosEcardSendForm->validate($_POST); // Line 61: sanitized ```

The sanitized value is stored in `$formValues['ecard_message']`, but this value is never used. Instead, the raw `$postMessage` is passed to `parseEcardTemplate()` at lines 159 and 201:

```php $ecardHtmlData = $funcClass->parseEcardTemplate($imageUrl, $postMessage, ...); // Line 159 $ecardHtmlData = $funcClass->parseEcardTemplate($imageUrl, $postMessage, ...); // Line 201 ```

### Template Injection

File: `D:\bugcrowd\admidio\repo\src\Photos\ValueObject\ECard.php`, line 144

The `parseEcardTemplate()` method places the message directly into the HTML t…