whiteov3rflow/cve-2025-2304-pocProof-of-concept exploit for CVE-2025-2304, a mass assignment vulnerability in Camaleon CMS < 2.9.1 allowing authenticated privilege escalation to admin via crafted password change request.
Privilege Escalation in Camaleon CMS < 2.9.1
Mass assignment vulnerability in the updated_ajax method allows authenticated users to escalate privileges to admin by injecting password[role]=admin parameter during password change.
python3 exploit.py <url> <username> <password>
python3 exploit.py http://target.com attacker attacker
After successful exploitation, logout and login again to gain admin privileges.
