CVE-2024-35010
📋 TL;DR
This CSRF vulnerability in idccms v1.35 allows attackers to trick authenticated administrators into performing unauthorized actions, specifically deleting banner advertisements via the /admin/banner_deal.php endpoint. Attackers can craft malicious requests that execute when an admin visits a compromised page while logged in. This affects all idccms v1.35 installations with admin panel access.
💻 Affected Systems
- idccms
📦 What is this software?
Idccms by Idccms
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of website content management through unauthorized deletion of banners, potentially leading to defacement, loss of advertising revenue, or disruption of site functionality.
Likely Case
Unauthorized deletion of banner advertisements, causing temporary disruption to site advertising and requiring manual restoration of deleted content.
If Mitigated
No impact if proper CSRF protections are implemented or if administrators use separate browser sessions for admin tasks.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated admin into clicking malicious link.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Consider upgrading to newer version if available or implementing CSRF protections manually.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF token validation to banner_deal.php and all admin endpoints
Manual code modification required - add token generation and validation
Restrict Admin Access
allLimit admin panel access to specific IP addresses or VPN
Add IP restrictions to .htaccess or web server config
🧯 If You Can't Patch
- Implement SameSite cookie attributes and require re-authentication for sensitive actions
- Use separate browser sessions for admin tasks and regular browsing
🔍 How to Verify
Check if Vulnerable:
Check if /admin/banner_deal.php endpoint lacks CSRF token validation and accepts GET requests for delete operationsCheck Version:
Check CMS version in admin panel or configuration filesVerify Fix Applied:
Verify that banner_deal.php now requires CSRF tokens and rejects unauthorized requests📡 Detection & Monitoring
Log Indicators:
- Multiple banner deletion requests from same admin session in short timeframe
- Referer headers pointing to external domains in admin requests
Network Indicators:
- HTTP GET requests to /admin/banner_deal.php?mudi=del with external referers
SIEM Query:
source="web_server" AND uri="/admin/banner_deal.php" AND query="mudi=del" AND referer NOT CONTAINS "yourdomain.com"