Multiple vulnerabilities in Agora-Project (≤ 26.5.2)

Agora Project is an open-source collaborative groupware (shared spaces, calendars, forums, polls, file sharing, messaging, LDAP directory sync). During a security assessment of version 26.5.2, Akailabs identified 29 vulnerabilities, ranging from an unauthenticated remote code execution to a broad set of injection, access-control, authentication and cross-site-scripting issues. Several of them chain together into realistic, high-impact attack paths - from a plain user account to full administrator, or from any member to a complete database compromise.

Beyond identifying the vulnerabilities, Akailabs carried out a reconnaissance effort to map the assets exposing this application on the internet. The goal of that work is to notify the various owners and administrators of affected instances that vulnerabilities have been discovered in the application, so that they can update their instances to a fixed version before an attacker exploits them.

This article summarises the findings, explains each class of issue in plain terms, and walks through the kill-chains that tie them together. It deliberately stays at a conceptual level: the intent is to help defenders understand and prioritise, not to provide turn-key exploits. All testing was performed against a local lab instance. No third-party or production system was touched.

The issues have been reported to the vendor and assigned the CVE identifiers listed below.

Remote code execution

Description

While an instance is deployed but not yet configured, the public installation form writes attacker-supplied database settings into config.inc.php as define() statements without escaping. Because that file is included on every request, a value carrying a PHP string-interpolation construct is evaluated as code, giving an unauthenticated attacker command execution as the web user.

Cross-site scripting

Description

The $_FILES superglobal never passes through the framework's central input filter, so an uploaded attachment's filename reaches storage and two HTML rendering sinks completely unescaped. Any user who can attach a file plants persistent JavaScript that runs for every later reader of that object.

Description

The same $_FILES filter gap applies to poll-response file attachments with a non-image extension: the raw filename is stored and rendered unescaped in the dashboard poll view, producing persistent, zero-click XSS on the space home page for every member who loads it.

Description

The post-login redirect parameter objUrl is sanitized with FILTER_SANITIZE_URL, which does not strip the double quote, and is echoed unescaped inside an inline script that assigns window.top.location.href. One flaw yields both an open redirect and a reflected XSS.

Description

The pre-auth launchVisio action applies urldecode() to the visioURL parameter after the framework's HTML-encoding filter, so a double-encoded payload reconstructs HTML metacharacters the filter never saw. Any unauthenticated visitor following a crafted link runs attacker JavaScript in the application origin.

Description

A saved bookmark URL (adress) passes only through FILTER_SANITIZE_URL, which keeps JavaScript metacharacters, and is echoed raw into a single-quoted window.open('...') string inside an onclick. A low-privileged member can plant a payload that breaks out and runs arbitrary JavaScript when another member clicks the link.

Description

The LDAP-import preview renders every directory attribute value through a charset-conversion helper with no HTML escaping, into both a table cell and a hidden form field. Because the base DN and filter are pre-filled with configured defaults, a space admin is popped simply by opening the import menu when one directory entry carries a poisoned value.

Description

The central input filter Req::paramFilter() only sanitizes array values one level deep. The LDAP-import preview submits fields as a two-dimensional array (personFields[lineCpt][fieldCpt]), which falls through the filter unescaped, is written into ap_user/ap_contact records, and later rendered raw on the profile page: a stored XSS driven by a self-service LDAP attribute.

Description

A substring-match weakness in the URI.SafeIframeRegexp rule lets any user inject an attacker-controlled iframe into a Messenger message, yielding a zero-click drive-by download (iframe to a non-renderable resource) and arbitrary JavaScript execution inside an attacker-hosted iframe.

Description

The theme description is stored through the HTMLPurifier branch, which preserves the literal double quote, then echoed raw into a value="..." attribute on the editor page. A member who can add a theme can break out of the attribute and install an onfocus handler that runs when any user (including an admin) opens the editor and focuses the field.

SQL injection

Description

The shared category-filter parameter _idCategoryFilter is HTML-escaped on input, stored in the session, then re-read and concatenated unquoted into a numeric SQL WHERE term. HTML escaping never protected the SQL context, so any authenticated member achieves full error-based database exfiltration and, via stacked queries, arbitrary DDL/DML; the session-stored payload also re-fires on later requests.

Description

The people-import feature uses client-supplied agoraFields[] values directly as SQL column names, blocking only login/pass. A space admin can inject generalAdmin to write generalAdmin=1 on an imported record, escalating to full instance administrator in a single request.

Description

actionMyEvents() builds the ORDER BY clause by directly concatenating the sortEvents parameter with no whitelist or binding. Any authenticated user can substitute an arbitrary subquery for the sort column and exfiltrate the whole database via error-based or time-based channels.

Description

A general admin can store a malicious personsSort value in global settings; the write is protected by PDO::quote, but the value is later re-read and concatenated unquoted into an ORDER BY clause reachable by every authenticated user, turning one admin write into a persistent, globally-triggered SQL injection.

Authentication and session management

Description

Temporary passwords issued at self-registration, bulk import, and contact-to-user conversion are derived from substr(uniqid(),0,8), which is simply the epoch second of generation. An attacker who knows roughly when an account was created can predict its password from a few candidates and log in before the victim changes it.

Description

A legacy authentication branch compares the AGORAP_PASS cookie directly against the stored bcrypt hash by raw SQL equality instead of password_verify(). Anyone who obtains the stored hash (for instance via SQL injection) can forge the cookie and authenticate without cracking it.

Description

The password-reset token is a deterministic, non-expiring, non-single-use sha1(login . storedHash). An attacker who obtains the stored hash can recompute the token offline and reset the account's password without ever receiving the reset email.

Description

The persistent-login token is stored verbatim and checked by raw SQL equality rather than hashed at rest and verified. Any read of that value (SQL injection, XSS on the flag-less cookie, or network interception) yields a directly-replayable session credential valid for up to a year.

Description

The session starts before authentication and its identifier is never regenerated on login; the server also accepts an arbitrary client-supplied identifier (session.use_strict_mode is off). An attacker can fix a known identifier on the victim and ride their authenticated session.

Cross-site request forgery

Description

No form carries a CSRF token, no action checks Origin/Referer, and the session cookie lacks SameSite, HttpOnly, and Secure. A same-origin XSS (or a cross-site request in the fresh-cookie window) can drive the user-creation endpoint to create a new generalAdmin account, yielding full administrative takeover.

Access control, IDOR and broken tenancy

Description

Personal calendars are auto-provisioned without a creation date (dateCrea stays NULL), so the iCal share token md5($_id.$dateCrea.$_idUser) collapses to md5($_id.$_idUser), a hash of two small sequential integers, one of which the attacker already supplies in the URL. The unauthenticated DisplayIcal route then lets anyone enumerate identifiers and read any user's private calendar.

Description

The rights method setAffectations() scopes its DELETE to the caller's own spaces but performs the INSERT with an attacker-controlled _idSpace taken verbatim from the objectRight[] parameter. Any member with edit rights can grant a foreign space access to one of their objects, breaking tenant isolation, with a recursive flag extending it to a whole folder tree.

Description

A mobile-app download shortcut accepts md5(fileName) as an alternative to a real readRight() check. Because a filename is not a secret (unsalted md5, computable offline, and handed out by the server in mobile mode), any authenticated user can download any file from any space across tenant boundaries by enumerating file ids.

Description

The mail composer's resend feature resolves reloadMailTypeId through Ctrl::getCurObj(), an object loader with no access-control check. Any authenticated non-guest user can point it at another user's mail id to read its title, body and attachment list, and copy the victim's attachments into a mail delivered to themselves, across space boundaries.

Description

For shared and resource calendars the iCal token md5($_id.$dateCrea.$_idUser) is compromised through two HTTP-observable channels - forging it from a leaked creation minute, or reading it back from a token oracle in the feed - allowing unauthorized calendar reads.

Description

The user-edit action vueEditUser that creates accounts applies no admin check for a new user, because the generic object-creation right returns true for any authenticated user on a user object. Any ordinary member can create a real, usable account (privilege escalation itself remains blocked), enabling unauthorized account creation and quota exhaustion.

Description

MdlObject::accessRight() grants full read/write to any object whose stored author id matches the current user, via isAutor(), with no check of current space membership. A user revoked from a space keeps full access to every object they authored there until those objects are deleted or reassigned.

Description

The user-import action is gated only on whether the caller is an admin of the current space, but it inserts each spaceAffectList[] target space id verbatim into ap_joinSpaceUser without checking the caller administers those spaces. A space admin can import users into an unrelated space and, thanks to the predictable default password, log in as the resulting ghost account.

Path traversal

Description

actionUploadTmpFile() builds the destination path by concatenating the user-controlled tmpFolderName onto DATAS/tmp/ without confining it. The guard regex preg_match("/[a-z0-9]/i", $val) only checks that the value contains an alphanumeric, not that it is wholly alphanumeric, so a traversal sequence escapes the temp directory and writes files anywhere the web user can reach.

Kill-chains

Individually these issues are serious; combined, they form a handful of realistic end-to-end attack paths. Akailabs describes four below, kept at a conceptual level.

Kill-chain A - Deployment compromise: unauthenticated visitor to server RCE

Applies to an instance that is deployed but not yet configured.

1. The attacker reaches the public installation page of an unconfigured instance.
2. He submit the installation form with a database field crafted to carry a code-execution construct (CVE-2026-63146).
3. The value is written unescaped into the configuration file, which is included on every request, so the injected command runs as the web user.
4. Result: full remote code execution on the server, with no authentication and no prior access.

Kill-chain B - Plain user to reliable creation of an administrator account

The headline scenario: a standard member reliably obtains a generalAdmin account without attacking any admin-only endpoint head-on.

1. Prepare the environment: As an ordinary member, the attacker abuses the path-traversal file write (CVE-2026-63162) to drop a same-origin payload file into the web root. This defeats the two practical obstacles (the short length limit on the injection point and the same-origin policy) by hosting the full payload on the target's own domain.
2. Arm a passive trap: They create a dashboard poll whose response carries a file attachment whose filename is a short loader. Because $_FILES bypasses the input filter (CVE-2026-63148), the filename is stored and rendered unescaped on the space home page, visible to all members including admins.
3. Wait for the victim: An administrator views their dashboard in the normal course of work. The stored filename renders as a live element whose handler fires automatically, with no click required.
4. Leverage the missing CSRF defenses: The handler fetches the same-origin payload and executes it. Because no state-changing action checks a CSRF token or Origin, and the session cookie is sent on the same-origin request (CVE-2026-63150), the administrator's own session silently creates a new generalAdmin account (the permissive creation endpoint of CVE-2026-63172 helps here).
5. Result: the attacker logs in to the freshly created administrator account and holds full instance control.

Kill-chain C - Any member to full database compromise to account takeover

1. SQL Injection: Any authenticated member exploits one of the injection points (the session-mediated category filter (CVE-2026-63152), the sortEvents ORDER BY (CVE-2026-63165), or the stored personsSort (CVE-2026-63167) ) to exfiltrate the whole database, including stored password hashes and auth-token values.
2. Convert hashes into access without cracking: Using the dumped hashes, the attacker forges a pass-the-hash cookie (CVE-2026-63158), recomputes the deterministic reset token to reset a victim's password (CVE-2026-63159), or replays the verbatim remember-me token (CVE-2026-63160). Any of these yields authenticated access as another user.
3. Escalation. From a space-admin foothold, the SQL-identifier injection in people-import (CVE-2026-63154) writes generalAdmin=1, promoting the attacker to full instance administrator.
4. Result: database-wide disclosure followed by takeover of arbitrary accounts up to and including general administrator.

Kill-chain D - Cross-tenant data theft (no admin needed)

1. Break tenant isolation: A member grants a foreign space access to their own objects (CVE-2026-63153), or a space admin places users into an unrelated space (CVE-2026-63174) and logs in as the resulting predictable-password ghost account (CVE-2026-63149).
2. Harvest cross-space data: From that position the attacker downloads arbitrary files across spaces via the md5(filename) token bypass (CVE-2026-63163), reads and exfiltrates other users' emails and attachments through the mail IDOR (CVE-2026-63164), and reads private or shared calendars through the weak iCal share tokens (CVE-2026-63151, CVE-2026-63170).
3. Result: wholesale cross-tenant exfiltration of files, mail, and calendars without any administrative privilege.