htb-facts

HTB — Facts Easy/Linux - Season 10 Summary Facts is an Easy Linux machine that requires exploiting a known vulnerability CVE-2025-2304 in Camaleon CMS to extract local AWS S3 credentials. Enumerating the internal S3 buckets reveals an SSH private key that must be cracked using John the Ripper to...

CVE-2025-2304-POC

CVE-2025-2304-POC Manual poc for CVE-2025-2304: Camaleon CMS Version 2.9.0 Exploitation Steps 1. Log in as a low-privileged user e.g., "Bob". 2. Intercept the password change using a proxy e.g Burpsuite, caido and more 3. Capture the updatedajax request during a password change. 4. Inject the...

CVE-2025-2304-exploit

CVE-2025-2304 - Camaleon CMS Mass Assignment Privilege Escalation 📌 Project Description CVE-2025-2304 is a Mass Assignment vulnerability in Camaleon CMS versions 2.9.1 that allows an authenticated user to elevate their privileges to administrator by manipulating the role parameter in password...

CVE-2024-48652

CVE-2024-48652 Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field Steps to Reproduce: 1.Open the URL: http://127.0.0.1/admin/dashboard 2.Log in using admin credentials. 3.Navigate to the "Settings" section...

CVE-2025-2304

Camaleon CMS v2.9.1 - Mass Assignment leads to Privilege Escalation Exploit Tool - PoC Description This project is a Python-based exploitation proof of concept tool that demonstrates and analyzes a privilege escalation vulnerability affecting v2.9.1 of Camaleon CMS. The script automates the proce...

CVE-2025-2304

Camaleon CMS -p Arguments -t, --target Base target URL -u, --username Valid low-privileged username -p, --password User password Exploit Flow 1. Retrieve login page and extract CSRF token 2. Authenticate with provided credentials 3. Access profile edit page 4. Extract password update endpoint and...

CVE-2024-46987

CVE-2024-46987: Automated Path Traversal 📖 Overview This repository contains a Python-based Proof of Concept PoC for CVE-2024-46987. This vulnerability is a Path Traversal flaw found in file download modules of certain CMS environments notably Camaleon CMS Version 2.9.0 The script automates the...

CVE-2024-46987

CVE-2024-46987 - Camaleon CMS Local File Inclusion Authenticated Local File Inclusion LFI exploit for Camaleon CMS. Vulnerability Camaleon CMS is vulnerable to an authenticated LFI attack through the /admin/media/downloadprivatefile endpoint. The file parameter is not properly sanitized, allowing...

CVE-2023-30145

Description: Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter. Affected Component: All versions that are below 2.7.0 Fixed version: Fixed Versions: 2.7.4 Step to reproduce : Detection: 1.open below...

CVE-2024-46987

CVE-2024-46987 Exploit - Camaleon CMS Path Traversal This tool exploits a Path Traversal vulnerability in Camaleon CMS CVE-2024-46987. It allows for arbitrary file download and includes an automated feature to attempt to retrieve SSH keys from users discovered on the system. Features Arbitrary Fi...

CVE-2025-2304-PoC

CVE-2025-2304 Exploit Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment Vulnerability Description A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updatedajax' method of the UsersController is called. T...

CVE-2025-2304_POC

CVE-2025-2304POC CVE-2025-2304 POC - Camaleon CMS Privilege Escalation This POC is used to exploit Camaleon CMS privileges to administrator. The exploit works by injecting role into the password reset function of an authenticated user. Prerequisites & Assumptions You have a user account on the...

CVE-2025-2304-CamaleonCMS-PoC

PoC: CVE-2025-2304 - Camaleon CMS Privilege Escalation Technical Overview This repository contains a Functional Proof of Concept PoC for a Mass Assignment vulnerability in Camaleon CMS versions prior to 2.8.1. The vulnerability resides in the updatedajax endpoint of the User Management module,...

CVE-2025-2304

CVE-2025-2304 - Camaleon CMS 2.9.0 - Privilege Escalation Exploit Overview This Python script exploits a critical mass assignment vulnerability in Camaleon CMS version 2.9.0, allowing any registered user to escalate their privileges to administrator. Vulnerability Details CVE : CVE-2025-2304 - Ma...

CVE-2024-46987

CVE-2024-46987 — Camaleon CMS Arbitrary Path Traversal For authorised security assessments, penetration testing engagements, and educational research only. Overview Field| Detail ---|--- CVE| CVE-2024-46987 Product| Camaleon CMS Versions| = 2.8.0, 2.8.2 also confirmed on 2.9.0 Type| Path Traversa...

CVE-2025-2304-Camaleon-CMS-Mass-Assignment-Privilege-Escalation-PoC

CVE-2025-2304 — Camaleon CMS Mass Assignment Privilege Escalation PoC Privilege escalation vulnerability in Camaleon CMS /updatedajax with passwordrole=admin injected into the password parameters. 4. Verifies the role has been updated to admin. Requirements Python 3 Install dependencies: python3 ...

Exploit-for-CVE-2025-2304

Exploit-for-CVE-2025-2304 usage: exploit.py -h --url URL --username USERNAME --password PASSWORD Description Camaleon CMS is affected by a privilege escalation vulnerability due to unsafe mass assignment. The updatedajax method in UsersController uses the permit! function, allowing unfiltered...

CVE-2025-2304-POC

CVE-2025-2304-POC PoC for CVE-2025-2304 — Camaleon CMS 2.9.0 privilege escalation via mass assignment on the password change endpoint. Vulnerability The /admin/users/:id/updatedajax endpoint does not filter the role parameter before passing it to the model update, allowing any authenticated user ...

Camaleon CMS < 2.8.1 Arbitrary File Write to RCE

An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on depending on the permissions of the underlying filesystem. E.g. This can lead to a remote...

CVE-2025-2304

CVE-2025-2304 - Camaleon CMS Privilege Escalation This repository contains a Python script that automates the exploitation of the CVE-2025-2304 privilege escalation vulnerability in Camaleon CMS. It has been tested on version 2.9.0. Usage python exp.py http://target.exmaple user password123 Links...