CVE-2024-36669
📋 TL;DR
This CSRF vulnerability in idccms v1.35 allows attackers to trick authenticated administrators into performing unauthorized actions via the admin/type_deal.php endpoint. Attackers can add content types or perform other administrative functions without the admin's knowledge. Only administrators with access to the admin panel are affected.
💻 Affected Systems
- idccms
📦 What is this software?
Idccms by Idccms Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of CMS content management - attackers could add malicious content types, modify site structure, or potentially chain with other vulnerabilities for full system takeover.
Likely Case
Unauthorized content type creation leading to site defacement, SEO spam injection, or creation of backdoor access points.
If Mitigated
Limited impact with proper CSRF tokens and same-origin policies in place, though some administrative actions might still be vulnerable.
🎯 Exploit Status
CSRF attacks are well-understood and easy to weaponize. The provided GitHub reference shows proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
1. Check for official patch from idccms developers
2. If no patch, implement CSRF protection manually
3. Add anti-CSRF tokens to admin forms
4. Validate referer headers
5. Implement same-origin policy checks
🔧 Temporary Workarounds
Add CSRF Token Protection
allManually implement CSRF tokens in admin/type_deal.php and verify them on form submission
Edit admin/type_deal.php to generate and validate unique tokens per session
Restrict Admin Panel Access
allLimit admin panel access to specific IP addresses or network segments
Add IP restrictions to .htaccess or web server configuration for /admin/ directory
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block CSRF attempts
- Require re-authentication for sensitive administrative actions
🔍 How to Verify
Check if Vulnerable:
Review admin/type_deal.php source code for missing CSRF token validation in POST requestsCheck Version:
Check CMS version in admin panel or readme filesVerify Fix Applied:
Test form submissions with and without valid CSRF tokens to ensure proper validation📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to admin/type_deal.php from different referers
- Unauthorized content type creation in admin logs
Network Indicators:
- CSRF attack payloads in HTTP requests
- Suspicious referer headers in admin panel requests
SIEM Query:
source="web_logs" AND uri="/admin/type_deal.php" AND method="POST" AND (NOT referer CONTAINS "your-domain.com")