0xk4rth1/cve-2025-2304A critical mass assignment vulnerability in Camaleon CMS (< 2.9.1) allows authenticated low-privileged users to elevate their privileges to administrator. The flaw exists in the `updated_ajax`
This project is a Python-based exploitation proof of concept tool that demonstrates and analyzes a privilege escalation vulnerability affecting >v2.9.1 of Camaleon CMS. The script automates the process of authenticating to a target instance, retrieving application state information, and validating whether a vulnerable code path is present.
pip install requests beautifulsoup4
python exploit.py --target <host> --port <port> -u <username> -p <password>
python exploit.py --target example.com --port 80 -u testuser -p Password123
usage: exploit.py [-h] --target TARGET --port PORT -u U -p P
CVE-2025-2304 - Camaleon CMS >2.9.1 Privilege Escalation by Mass Assignment
Exploit Tool - PoC
options:
-h, --help show this help message and exit
--target TARGET Enter the target domain or ip.
Ex: -t example.com
--port PORT Enter target port
-u U Enter Camaleon CMS Username
-p P Enter Camaleon CMS Password
project/ ├── exploit.py └── README.md
This project is provided for security research and educational purposes. Users are responsible for ensuring compliance with all applicable laws and authorization requirements before use.
| Argument | Required | Description |
|---|
--target | Yes | Target domain or IP address (e.g. example.com) |
--port | Yes | Target service port. Default: 80 |
-u | Yes | Camaleon CMS username |
-p | Yes | Camaleon CMS password |