PT-2024-26292 · Idccms · Idccms

Thirtypenny77

·

CVE-2024-35012

·

Published

2024-05-14

·

Updated

2024-07-03

CVSS v3.1

6.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions idccms version 1.35
Description A Cross-Site Request Forgery (CSRF) issue was discovered in the component "/admin/infoType deal.php?mudi=add&nohrefStr=close".
Recommendations For idccms version 1.35, consider disabling access to the "/admin/infoType deal.php" endpoint until a patch is available. Restrict the use of the mudi and nohrefStr parameters in this endpoint to minimize the risk of exploitation.

Exploit

Fix

CSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-35012

Affected Products

Idccms