CVE-2023-45906
📋 TL;DR
Dreamer CMS v4.1.3 contains a CSRF vulnerability in the user addition function at /admin/user/add. This allows attackers to trick authenticated administrators into unknowingly creating new user accounts with arbitrary privileges. Any Dreamer CMS installation using the vulnerable version is affected.
💻 Affected Systems
- Dreamer CMS
📦 What is this software?
Dreamer Cms by Iteachyou
⚠️ Risk & Real-World Impact
Worst Case
Attackers create administrative accounts, gaining full control over the CMS to modify content, install backdoors, or pivot to other systems.
Likely Case
Attackers create regular user accounts to access sensitive content, post malicious content, or maintain persistence for future attacks.
If Mitigated
With proper CSRF protections, attackers cannot force user creation, limiting impact to other vulnerabilities requiring authentication.
🎯 Exploit Status
Exploitation requires tricking an authenticated admin to visit a malicious page while logged in.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing CSRF protections manually.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF token validation to the /admin/user/add endpoint
Modify Dreamer CMS source code to include and validate CSRF tokens in user addition forms
Restrict Admin Access
allLimit admin interface access to trusted IP addresses only
Configure web server (e.g., Apache .htaccess or Nginx location blocks) to restrict /admin paths
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block CSRF attempts
- Require re-authentication for sensitive actions like user creation
🔍 How to Verify
Check if Vulnerable:
Check if Dreamer CMS version is 4.1.3 and if /admin/user/add endpoint lacks CSRF protectionCheck Version:
Check CMS configuration files or admin dashboard for version informationVerify Fix Applied:
Test that user addition requests now require valid CSRF tokens📡 Detection & Monitoring
Log Indicators:
- Multiple user creation requests from same IP without corresponding form submissions
- User creation requests missing referrer headers or CSRF tokens
Network Indicators:
- POST requests to /admin/user/add with suspicious referrers or origins
SIEM Query:
source="web_logs" AND uri="/admin/user/add" AND method="POST" AND (referrer NOT CONTAINS "your-domain.com" OR csrf_token MISSING)