CVE-2024-9282: 1234n Minicms CSRF Vulnerability

CVE-2024-9282 Overview

CVE-2024-9282 is a cross-site request forgery [CWE-352] vulnerability in bg5sbk MiniCMS version 1.11. The flaw resides in an unknown function within the page-edit.php file. An attacker can trigger unauthorized state-changing actions in the context of an authenticated administrator by luring the victim to a crafted web resource.

The exploit has been publicly disclosed and can be launched remotely without prior authentication on the attacker's side. The vendor was contacted early but did not respond. The initial researcher advisory contained ambiguous version and file name information, which complicates precise scoping.

Critical Impact
Remote attackers can coerce authenticated MiniCMS administrators into executing unintended actions against page-edit.php, resulting in unauthorized content modification.

Affected Products

bg5sbk MiniCMS 1.11
1234n:minicms package (per NVD CPE data)
MiniCMS deployments exposing page-edit.php to authenticated administrators

Discovery Timeline

2024-09-27 - CVE-2024-9282 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-9282

Vulnerability Analysis

The vulnerability is a cross-site request forgery (CSRF) issue in MiniCMS 1.11. The affected code path is inside page-edit.php, which handles page editing actions in the administrative interface. The application processes state-changing requests without validating a per-session anti-CSRF token or verifying request origin.

An attacker hosts a malicious page containing a forged request targeting the MiniCMS admin endpoint. When an authenticated administrator visits the page, the browser automatically attaches session cookies to the outbound request. The server accepts the request as legitimate and executes the requested modification.

The attack requires no privileges on the attacker side and no interaction beyond the victim visiting a controlled resource. Impact is limited to integrity of content managed by MiniCMS; confidentiality and availability are not directly affected according to the CVSS 4.0 vector.

Root Cause

The root cause is missing CSRF protection on the request handler in page-edit.php. The application does not validate an unpredictable per-request token, and it does not enforce SameSite cookie attributes or Origin/Referer checks. Any authenticated session is therefore usable by an attacker-crafted cross-origin request.

Attack Vector

Exploitation is network-based and requires an authenticated MiniCMS administrator to visit or interact with an attacker-controlled page. The attacker delivers the CSRF payload through phishing emails, forum posts, or compromised third-party sites. The malicious page issues an HTTP request to the MiniCMS page-edit.php endpoint, and the victim's browser transmits the session cookie along with the forged parameters.

See the GitHub Issue Report and VulDB entry #278664 for the public disclosure details.

Detection Methods for CVE-2024-9282

Indicators of Compromise

Unexpected modifications to pages managed by MiniCMS with no corresponding administrator activity in access logs.
HTTP POST requests to page-edit.php with Referer or Origin headers pointing to unrelated external domains.
Administrator session activity originating from browsers immediately after visits to untrusted URLs.

Detection Strategies

Inspect web server logs for requests to page-edit.php where the Referer header does not match the MiniCMS host.
Enable web application firewall rules that flag cross-origin POST requests to administrative endpoints.
Correlate authenticated admin actions with browser history and email gateway telemetry to identify user-driven triggers.

Monitoring Recommendations

Monitor changes to MiniCMS content files and database records for unauthorized edits.
Alert on administrator sessions performing edit actions outside of established working hours.
Track outbound clicks by administrators from webmail and messaging platforms to previously unseen domains.

How to Mitigate CVE-2024-9282

Immediate Actions Required

Restrict access to the MiniCMS administrative interface to trusted IP ranges or VPN-only networks.
Require administrators to log out of MiniCMS before browsing untrusted content in the same browser profile.
Deploy a reverse proxy or WAF rule that rejects requests to page-edit.php lacking a same-origin Referer or Origin header.

Patch Information

No vendor patch is currently referenced in the NVD entry, and the vendor did not respond to disclosure. Operators should track the upstream MiniCMS GitHub repository for community fixes and consider migrating to an actively maintained CMS if updates remain unavailable.

Workarounds

Enforce SameSite=Strict or SameSite=Lax on the MiniCMS session cookie at the reverse proxy layer to block cross-site cookie attachment.
Add a front-end CSRF token check by wrapping page-edit.php behind an authenticating proxy that validates a synchronizer token.
Segment the admin interface using HTTP basic authentication or client certificates so that browser-based CSRF requests fail authentication.

bash

# Example nginx snippet enforcing same-origin requests to page-edit.php
location ~ /page-edit\.php$ {
    if ($http_origin !~* ^https?://minicms\.example\.com$) {
        return 403;
    }
    if ($request_method = POST) {
        set $block 1;
        if ($http_referer ~* ^https?://minicms\.example\.com/) {
            set $block 0;
        }
        if ($block = 1) {
            return 403;
        }
    }
    proxy_pass http://minicms_backend;
}