CVE-2022-33121
📋 TL;DR
This CSRF vulnerability in MiniCMS v1.11 allows attackers to trick authenticated users into clicking malicious links that delete local .dat files. Any MiniCMS v1.11 installation with authenticated users is affected, potentially leading to data loss or system disruption.
💻 Affected Systems
- MiniCMS
📦 What is this software?
Minicms by 1234n
⚠️ Risk & Real-World Impact
Worst Case
Critical configuration or data files are deleted, causing complete CMS failure, data loss, and potential privilege escalation if system files are affected.
Likely Case
CMS data files are deleted, causing content loss, broken functionality, and requiring restoration from backups.
If Mitigated
No impact if proper CSRF protections are implemented or if the system is patched.
🎯 Exploit Status
Exploit requires authenticated user to click malicious link; trivial to weaponize as simple HTML page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.12 or later
Vendor Advisory: https://github.com/bg5sbk/MiniCMS/issues/45
Restart Required: No
Instructions:
1. Download latest MiniCMS version from official repository. 2. Backup current installation. 3. Replace vulnerable files with patched version. 4. Verify CSRF tokens are now properly implemented.
🔧 Temporary Workarounds
Implement CSRF Protection
allAdd CSRF tokens to all state-changing requests manually
Restrict File Deletion Permissions
linuxSet .dat files to read-only for web server user
chmod 444 *.dat
chown root:root *.dat
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block CSRF attempts
- Educate users about phishing risks and implement strict access controls
🔍 How to Verify
Check if Vulnerable:
Check MiniCMS version in admin panel or by examining source files for version 1.11Check Version:
grep -r 'version' *.php or check admin dashboardVerify Fix Applied:
Verify version is 1.12+ and test that state-changing requests require CSRF tokens📡 Detection & Monitoring
Log Indicators:
- Multiple .dat file deletion attempts
- Unauthorized file deletion requests from authenticated sessions
Network Indicators:
- POST requests to delete endpoints without CSRF tokens
- Suspicious referrer headers
SIEM Query:
source="web_logs" AND (uri="/delete" OR uri="/remove") AND method="POST" AND NOT csrf_token=*