CVE-2020-18418
📋 TL;DR
This CSRF vulnerability in FeiFeiCMS v4.1.190209 allows attackers to trick authenticated administrators into unknowingly creating new administrator accounts. Attackers can exploit this by luring administrators to malicious websites while logged into the CMS. This affects all deployments of FeiFeiCMS v4.1.190209 that have administrator interfaces accessible.
💻 Affected Systems
- FeiFeiCMS
📦 What is this software?
Feifeicms by Feifeicms
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the CMS instance with attacker gaining administrative privileges, potentially leading to data theft, defacement, or further system compromise.
Likely Case
Unauthorized administrator account creation leading to persistent access for attackers, enabling content manipulation, data extraction, or installation of backdoors.
If Mitigated
No impact if proper CSRF protections are implemented or if administrators don't visit malicious sites while authenticated.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated administrators into visiting malicious pages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
1. Upgrade to a patched version if available. 2. If no patch exists, implement CSRF tokens on all administrative endpoints. 3. Review and modify the /index.php?s=Admin-Admin-Insert endpoint to require CSRF validation.
🔧 Temporary Workarounds
Implement CSRF Protection
allAdd CSRF tokens to all administrative forms and validate them on submission.
Modify PHP files to include CSRF token generation and validation
Restrict Admin Interface Access
allLimit access to admin interface to specific IP addresses or VPN.
Add IP restrictions in .htaccess or web server configuration
🧯 If You Can't Patch
- Implement SameSite cookies and require re-authentication for sensitive actions
- Use browser extensions that block CSRF attempts and educate administrators about phishing risks
🔍 How to Verify
Check if Vulnerable:
Check if FeiFeiCMS version is 4.1.190209 and examine if /index.php?s=Admin-Admin-Insert endpoint lacks CSRF protection.Check Version:
Check CMS configuration files or admin panel for version informationVerify Fix Applied:
Test if administrative account creation requests now require valid CSRF tokens and fail without them.📡 Detection & Monitoring
Log Indicators:
- Multiple administrator account creation attempts from same session
- Admin-Admin-Insert requests without referrer validation
Network Indicators:
- POST requests to /index.php?s=Admin-Admin-Insert from unexpected referrers
SIEM Query:
source="web_logs" AND uri="/index.php" AND query="s=Admin-Admin-Insert" AND NOT referrer="*admin*"🔗 References
- https://github.com/GodEpic/Vulnerability-detection/blob/master/feifeicms/FeiFeiCMS_4.1_csrf.doc
- https://github.com/GodEpic/Vulnerability-detection/blob/master/feifeicms/poc
- https://github.com/GodEpic/Vulnerability-detection/blob/master/feifeicms/FeiFeiCMS_4.1_csrf.doc
- https://github.com/GodEpic/Vulnerability-detection/blob/master/feifeicms/poc
