CVE-2024-36667
📋 TL;DR
This CSRF vulnerability in idccms v1.35 allows attackers to trick authenticated administrators into performing unauthorized actions by visiting malicious web pages. Attackers could add new product types through the vulnerable admin endpoint without the victim's knowledge. Only administrators with access to the admin panel are affected.
💻 Affected Systems
- idccms
📦 What is this software?
Idccms by Idccms Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could add malicious product types, modify system configurations, or chain with other vulnerabilities to gain full system control.
Likely Case
Attackers add unauthorized product types or modify existing ones, potentially disrupting business operations or inserting malicious content.
If Mitigated
With proper CSRF protections, the attack fails as requests are rejected without valid tokens.
🎯 Exploit Status
Exploitation requires the victim to be logged into the admin panel and visit a malicious page. The vulnerability is well-documented in public repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement CSRF protection manually.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF token validation to /admin/idcProType_deal.php endpoint
Modify PHP code to generate and validate unique tokens per session
SameSite Cookie Attribute
allSet SameSite=Strict attribute on session cookies
session.cookie_samesite = Strict in php.ini or setcookie() with SameSite=Strict
🧯 If You Can't Patch
- Restrict admin panel access to specific IP addresses or VPN only
- Implement web application firewall (WAF) rules to detect and block CSRF attempts
🔍 How to Verify
Check if Vulnerable:
Check if /admin/idcProType_deal.php?mudi=add&nohrefStr=close endpoint accepts POST requests without CSRF token validationCheck Version:
Check idccms version in admin panel or configuration filesVerify Fix Applied:
Test that the endpoint now requires and validates a CSRF token for all state-changing operations📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /admin/idcProType_deal.php from different referrers
- Unusual product type additions in admin logs
Network Indicators:
- HTTP requests to vulnerable endpoint with suspicious referrer headers
- Pattern of requests without CSRF tokens
SIEM Query:
source="web_logs" AND uri="/admin/idcProType_deal.php" AND method="POST" AND NOT csrf_token=*