Exploit for CVE-2025-2304

CVE-2025-2304-POC PoC for CVE-2025-2304 — Camaleon CMS 2.9.0...

Exploit for CVE-2025-2304

CVE-2...

Exploit for CVE-2025-2304

CVE-2025-2304 Exploit Camaleon CMS Vulnerable to Privilege Es...

CVE-2025-2304

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updatedajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without a...

CVE-2025-2304

creationtimestamp| type| source ---|---|--- 2025-03-14 13:40:23+00:00| seen| https://bsky.app/profile/cyberalerts.bsky.social/post/3lkdqechp2b2a 2025-03-14 13:47:11+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/7546 2025-03-14 15:02:35+00:00| seen|...

CVE-2025-2304

CVE-2025-2304 describes a mass-assignment vulnerability in Camaleon CMS where the updated_ajax action in UsersController uses params.require(:user).permit! and thus accepts unfiltered keys. Exploitation paths documented in connected sources show an authenticated user can inject password[role]=adm...

CVE-2025-2304 Camaleon CMS Privilege Escalation

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updatedajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without a...