Description (CNA)
UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send a crafted POST request to /dist/admin/index.php with specific parameters to generate a new admin user with full system access.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Ulicms / Ulicms | affected 2023.1 |
CWE
CWE-862
References
- https://www.exploit-db.com/exploits/51433
- https://web.archive.org/web/20230314183734/https://en.ulicms.de/
- https://www.vulncheck.com/advisories/ulicms-privilege-escalation-via-unauthenticated-admin-account-creation
ADP enrichment
No English description supplied.