Description (CNA)
UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative account with full system access.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ulicms / Ulicms | affected 2023.1 |
CWE
CWE-639
References
- https://www.exploit-db.com/exploits/51486
- https://web.archive.org/web/20230314183734/https://en.ulicms.de/
- https://www.vulncheck.com/advisories/ulicms-authentication-bypass-via-mass-assignment-vulnerability
ADP enrichment
No English description supplied.