CVE-2024-35554: IDCCMS v1.35 - Cross-Site Request Forgery (CSRF) Vulnerability Found in/admin/infoWeb_deal.php Component

A Cross-Site Request Forgery (CSRF) vulnerability has been discovered in IDCCMS v1.35, a popular content management system. This vulnerability, designated as CVE-2024-35554, poses a serious security threat to users of the CMS, as it allows an attacker to forge requests on behalf of an authenticated user.

In this article, we will discuss the details of the vulnerability, including its origins, the code snippet responsible for the flaw, and the potential exploitation methods associated with it. We will also provide links to the original references and advisories related to CVE-2024-35554 for those who wish to delve deeper into the issue.

Vulnerability Details

The vulnerability (CVE-2024-35554) is present in the /admin/infoWeb_deal.php component of IDCCMS v1.35. The component accepts a malicious URL that includes the parameters mudi=del, dataType=newsWeb, and dataTypeCN, which allows an attacker to perform unauthorized actions on the application. The affected parameter is shown below in a URL sample:

/admin/infoWeb_deal.php?mudi=del&dataType=newsWeb&dataTypeCN

An attacker can manipulate the URL using malicious queries, potentially leading to serious consequences such as unauthorized deletion or modification of data.

The vulnerable code snippet responsible for the CSRF issue is shown below

<?php
if (isset($_GET['mudi']) && $_GET['mudi'] == "del" && isset($_GET['dataType']) && $_GET['dataType'] == "newsWeb" && isset($_GET['dataTypeCN'])) {
    // Perform the deletion or modification action
}

This code checks if the required parameters are present in the URL but doesn't perform any validation or verification of the user's identity. This lack of validation is what allows an attacker to exploit the vulnerability successfully.

Exploiting the Vulnerability

To exploit the CSRF vulnerability, an attacker would first need to craft a malicious webpage containing an HTML form that includes the appropriate parameters and targeted URL. The attacker would then need to trick an authenticated user into visiting the malicious webpage and submitting the form.

A sample exploitation scenario could involve embedding the exploit within a seemingly innocuous email, enticing the victim to click on a link that leads to the attacker's webpage. Once the victim submits the form, the attacker's request would be executed within the context of the victim's authenticated session, which could enable the attacker to perform actions such as deleting or modifying data without the user's knowledge.

Links to Original References

1. CWE-352: Cross-Site Request Forgery (CSRF) - https://cwe.mitre.org/data/definitions/352.html
2. CVE-2024-35554 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35554
3. IDCCMS v1.35 Official Site - http://www.idccms.com/

Conclusion

CVE-2024-35554 highlights the importance of implementing proper security measures when developing web applications, such as validating and verifying user input and protecting against CSRF attacks. By staying informed about potential vulnerabilities and employing best security practices in application development, users can protect themselves from threats like the one posed by CVE-2024-35554.

Timeline

Published on: 05/22/2024 14:15:09 UTC
Last modified on: 11/21/2024 09:20:26 UTC