PT-2024-28808 · Idccms · Idccms

Published 2024-07-10 · Updated 2024-07-12 · CVE-2024-40329

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions idccms version 1.35

Description The issue is a Cross-Site Request Forgery (CSRF) vulnerability. It can be exploited via the "/admin/softBak deal.php" API endpoint, specifically when the mudi parameter is set to "backup". This allows an attacker to perform unauthorized actions on the system.

Recommendations For idccms version 1.35, as a temporary workaround, consider restricting access to the "/admin/softBak deal.php" API endpoint to minimize the risk of exploitation. Avoid using the mudi parameter with the value "backup" in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-40329

Affected Products

Idccms

References · 6

• 🔥 https://github.com/Tank992/cms/blob/main/67/csrf.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-40329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40329 · Security Note
• https://t.me/cvedetector/543 · Telegram Post
• https://twitter.com/CVEnew/status/1811062888263569832 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1811045539120579058 · Twitter Post