CVE-2024-35012
📋 TL;DR
This CSRF vulnerability in idccms v1.35 allows attackers to trick authenticated administrators into performing unauthorized actions by visiting malicious web pages. Attackers could add information types to the CMS without the admin's knowledge. Only administrators with access to the affected admin panel are vulnerable.
💻 Affected Systems
- idccms
📦 What is this software?
Idccms by Idccms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could add malicious content types, modify site structure, or potentially chain with other vulnerabilities to gain full control of the CMS.
Likely Case
Attackers add unwanted information types or categories to the CMS, disrupting site organization and potentially enabling content injection.
If Mitigated
With proper CSRF protections and admin awareness, impact is limited to failed exploitation attempts.
🎯 Exploit Status
Exploitation requires admin to be logged in and visit malicious page. Simple HTML form can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Consider upgrading to newer version if available or implementing CSRF protections manually.
🔧 Temporary Workarounds
Add CSRF Token Protection
allImplement CSRF tokens in the admin/infoType_deal.php form to validate legitimate requests
Manual code modification required - add CSRF token generation and validation
Restrict Admin Panel Access
linuxLimit access to admin panel to specific IP addresses or internal network only
# Apache: Require ip 192.168.1.0/24
# Nginx: allow 192.168.1.0/24; deny all;
🧯 If You Can't Patch
- Implement SameSite cookies and require re-authentication for sensitive actions
- Use browser extensions that block CSRF attempts and educate administrators about phishing risks
🔍 How to Verify
Check if Vulnerable:
Check if /admin/infoType_deal.php?mudi=add&nohrefStr=close endpoint accepts POST requests without CSRF tokens when admin is logged inCheck Version:
Check CMS version in admin panel or readme filesVerify Fix Applied:
Test that POST requests to the vulnerable endpoint now require valid CSRF tokens📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /admin/infoType_deal.php from unexpected sources
- Unusual infoType creation events in admin logs
Network Indicators:
- HTTP requests to admin endpoints with Referer headers from external domains
- Unusual traffic patterns to admin panel
SIEM Query:
source="web_logs" AND uri="/admin/infoType_deal.php" AND method="POST" AND NOT referer CONTAINS "your-domain.com"