From 26217b318301b70868c38456d40d5cde019ecc7a Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 8 Apr 2025 14:54:00 +0000
Subject: [PATCH] Publish GHSA-x82r-6j37-vrgg

---
 .../GHSA-x82r-6j37-vrgg.json                  | 65 +++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/04/GHSA-x82r-6j37-vrgg/GHSA-x82r-6j37-vrgg.json

diff --git a/advisories/github-reviewed/2025/04/GHSA-x82r-6j37-vrgg/GHSA-x82r-6j37-vrgg.json b/advisories/github-reviewed/2025/04/GHSA-x82r-6j37-vrgg/GHSA-x82r-6j37-vrgg.json
new file mode 100644
index 00000000000..bf14f0b3bcb
--- /dev/null
+++ b/advisories/github-reviewed/2025/04/GHSA-x82r-6j37-vrgg/GHSA-x82r-6j37-vrgg.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x82r-6j37-vrgg",
+  "modified": "2025-04-08T14:51:41Z",
+  "published": "2025-04-08T14:51:41Z",
+  "aliases": [
+    "CVE-2025-30166"
+  ],
+  "summary": "Pimcore's Admin Classic Bundle allows HTML Injection",
+  "details": "### Summary\nAn HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content.\n\n### Details\nThe vulnerability was discovered in the `/admin/email/send-test-email` endpoint using the `POST` method. The vulnerable parameter is `content`, which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible.\n\n### PoC\nTo reproduce the vulnerability, a user must fill out the email's content form with the desired HTML payload.\n![send-test-mail-text](https://github.com/user-attachments/assets/0e02b004-ce88-4018-b7cb-ae15a8ec2300)\n\n### Impact\n![mail-text](https://github.com/user-attachments/assets/67080d10-0cef-4f65-a157-4f012203f0a3)\n\nThis HTML injection vulnerability can potentially enable phishing attacks by allowing the insertion of any html like fake login forms, etc.\nAll functionalities that process user input should be carefully reviewed to ensure that data is appropriately encoded as HTML entities in server responses. For instance, a reflected input paramete like `<h1> just a test </h1> <p> <img>` should be displayed in the HTML response as `&#x3c;h1&#x3e; just a test &#x3c;/h1&#x3e; &#x3c;p&#x3e; &#x3c;img&#x3e;`.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "pimcore/admin-ui-classic-bundle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.7.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-x82r-6j37-vrgg"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30166"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pimcore/admin-ui-classic-bundle/commit/76b690d4f8fcd9c9d41766bc5238c2513242e60e"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/pimcore/admin-ui-classic-bundle"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-08T14:51:41Z",
+    "nvd_published_at": "2025-04-08T11:15:44Z"
+  }
+}
\ No newline at end of file