Camaleon CMS < 2.9.1 – Privilege Escalation (Mass Assignment)

Description

This exploit targets Camaleon CMS versions < 2.9.1 and abuses a mass assignment vulnerability in the password update AJAX endpoint to escalate a low-privileged user to administrator.

Affected Versions

• Camaleon CMS < 2.9.1

Vulnerability Type

• Mass Assignment
• Privilege Escalation

Requirements

• Valid low-privileged user credentials
• Python 3
• Python modules:
  • requests
  • beautifulsoup4

Install dependencies:

pip install requests beautifulsoup4

Usage

python3 exploit.py -t http://target.com -u <username> -p <password>

Arguments

• -t, --target Base target URL
• -u, --username Valid low-privileged username
• -p, --password User password

Exploit Flow

1. Retrieve login page and extract CSRF token
2. Authenticate with provided credentials
3. Access profile edit page
4. Extract password update endpoint and CSRF token
5. Send forged PATCH request including password[role]=admin
6. Verify role escalation
7. Output valid session cookies

Successful Exploitation

On success, the script:

• Confirms authentication
• Updates the password
• Escalates the user role to admin
• Prints reusable session cookies

Mitigation

• Upgrade Camaleon CMS

Disclaimer

For educational and authorized security testing only. Unauthorized use is prohibited.