CVE-2024-36550
📋 TL;DR
This CSRF vulnerability in idccms V1.35 allows attackers to trick authenticated administrators into performing unauthorized actions via crafted requests to the admin panel. Attackers can add VPS company entries without proper authorization checks. Only administrators with access to the vulnerable admin endpoint are affected.
💻 Affected Systems
- idccms
📦 What is this software?
Idccms by Idccms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could add malicious VPS company entries, potentially leading to data manipulation, privilege escalation, or further compromise of the CMS installation.
Likely Case
Unauthorized addition of VPS company entries in the admin panel, potentially disrupting business operations or enabling further attacks.
If Mitigated
With proper CSRF protections, the vulnerability would be blocked, preventing unauthorized actions even if administrators visit malicious pages.
🎯 Exploit Status
CSRF attacks are well-understood and easy to weaponize. The GitHub reference shows proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Implement CSRF tokens in /admin/vpsCompany_deal.php and validate them on all POST requests.
🔧 Temporary Workarounds
Implement CSRF Protection
allAdd CSRF tokens to forms and validate them server-side
Edit /admin/vpsCompany_deal.php to include CSRF token generation and validation
Restrict Admin Access
allLimit admin panel access to specific IP addresses or networks
Add IP restrictions in .htaccess or web server configuration for /admin/ directory
🧯 If You Can't Patch
- Implement strict SameSite cookie policies for session cookies
- Require re-authentication for sensitive admin actions
🔍 How to Verify
Check if Vulnerable:
Check if /admin/vpsCompany_deal.php?mudi=add&nohrefStr=close endpoint lacks CSRF token validationCheck Version:
Check CMS version in admin panel or configuration filesVerify Fix Applied:
Verify that POST requests to the vulnerable endpoint now require and validate CSRF tokens📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /admin/vpsCompany_deal.php from different referrers
- Unauthorized VPS company additions in admin logs
Network Indicators:
- HTTP requests to the vulnerable endpoint with suspicious referrer headers
SIEM Query:
source="web_logs" AND uri="/admin/vpsCompany_deal.php" AND method="POST" AND NOT referrer CONTAINS "your-domain.com"