CVE-2025-2304-POC

CVE-2025-2304 PoC - Camaleon CMS Privilege Escalation A Proof of Concept PoC exploit for CVE-2025-2304 , a critical mass assignment vulnerability in Camaleon CMS that allows privilege escalation from low-privileged users to administrators. ██████╗ ██████╗ ██╗ ██╗███╗ ██╗ ██████╗ ███╗ ███╗██╗...

CVE-2025-2304-Camaleon-CMS-Mass-Assignment-Privilege-Escalation-PoC

CVE-2025-2304 — Camaleon CMS Mass Assignment Privilege Escalation PoC Privilege escalation vulnerability in Camaleon CMS /updatedajax with passwordrole=admin injected into the password parameters. 4. Verifies the role has been updated to admin. Requirements Python 3 Install dependencies: python3 ...

Mass-Assigner

Mass Assigner Mass Assigner is a powerful tool designed to identify and exploit mass assignment vulnerabilities in web applications. It achieves this by first retrieving data from a specified request, such as fetching user profile data. Then, it systematically attempts to apply each parameter...

Drupalgeddon2

CVE-2018-7600 | Drupal 7.58 / 8.3.9 / 8.4.6 / 8.5.1 - 'Drupalgeddon2' RCE SA-CORE-2018-002 مستوحى من https://github.com/dreadlocked/Drupalgeddon2 يدعم: Drupal 8.3.9 / 8.4.6 / 8.5.1 رابط user/register، مهاجمة account/mail ووسيط postrender، باستخدام دالة passthru في PHP قيد الانتظار لم تتم برمجته ب...

Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite

Hoppscotch self-hosted backend = 2026.4.1 contains a broken authentication caused by mass assignment via unauthenticated POST /v1/onboarding/config endpoint, letting unauthenticated attackers overwrite JWTSECRET to forge tokens and fully compromise the server, exploit requires attacker to access...

CVE-2025-2304-exploit

CVE-2025-2304 - Camaleon CMS मास असाइनमेंट विशेषाधिकार वृद्धि 📌 परियोजना विवरण CVE-2025-2304 Camaleon CMS संस्करण 2.9.1 में एक मास असाइनमेंट भेद्यता है जो एक प्रमाणित उपयोगकर्ता को पासवर्ड बदलने के अनुरोधों में role पैरामीटर में हेरफेर करके अपने विशेषाधिकारों को व्यवस्थापक तक बढ़ाने की अनुमति देत...

CVE-2025-2304-POC

CVE-2025-2304-POC دليل إثبات الثغرة لـ CVE-2025-2304: Camaleon CMS الإصدار 2.9.0 خطوات الاستغلال 1. سجل الدخول كمستخدم بصلاحيات منخفضة مثل "Bob". 2. اعترض تغيير كلمة المرور باستخدام وسيط مثل Burpsuite, caido وغيرها. 3. التقط طلب updatedajax أثناء تغيير كلمة المرور. 4. حقن المعامل passwordrole=adm...

CVE-2023-7028

GitLab CVE-2023-7028 POC [email protected]&[email protected] 科研机构base成都-招聘网络安全研究人员（私）...

HTB-Facts-Writeup

HackTheBox — شرح جهاز Facts معلومات الجهاز الحقل| التفاصيل ---|--- الاسم| Facts نظام التشغيل| Linux الصعوبة| سهلة الإصدار| الموسم 10 متقاعد| لا نظرة عامة على سلسلة الهجوم Recon → Web Enumeration → CVE-2025-2304 Mass Assignment → S3/MinIO Credential Leak → SSH Key Extraction → Passphrase Cracking ...

CVE-2025-2304

CVE-2025-2304 - Camaleon CMS 2.9.0 - विशेषाधिकार वृद्धि शोषण अवलोकन यह Python स्क्रिप्ट Camaleon CMS संस्करण 2.9.0 में एक गंभीर mass assignment भेद्यता का शोषण करती है, जो किसी भी पंजीकृत उपयोगकर्ता को अपने विशेषाधिकारों को व्यवस्थापक स्तर तक बढ़ाने की अनुमति देती है। भेद्यता विवरण CVE :...

CVE-2025-2304

Camaleon CMS 2.9.0 – Authenticated Privilege Escalation Role Change + Optional S3 Config Leak Target: Camaleon CMS v2.9.0 Type: Authenticated privilege escalation via mass-assignment in updatedajax role field Extras: Optional extraction of S3 configuration from the admin settings page if the...

CVE-2025-2304-POC

CVE-2025-2304 تصعيد الامتيازات في Camaleon CMS مثال python3 exploit.py http://target.com attacker attacker بعد نجاح الاستغلال، قم بتسجيل الخروج ثم تسجيل الدخول مرة أخرى للحصول على صلاحيات المسؤول. المراجع https://nvd.nist.gov/vuln/detail/CVE-2025-2304...

CVE-2026-102780

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns...

CVE-2026-102780 Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns...

CVE-2026-102780

The TF Content extension for Joomla (versions 2.9.0 - 2.9.4 ) by joomlafry.com is vulnerable to unauthenticated cross-record publication and mass assignment . The root cause is that the public RecordController unconditionally authorizes both creation and editing actions. Additionally, the shared ...

CVE-2026-102780 Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns...

EUVD-2026-92452

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns...

hdwebmobile-booking-appointments

HDWebmobile Booking & Appointments قم ببيع الخدمات والمواعيد القابلة للحجز عبر WooCommerce، مع سعة لكل فترة زمنية لا يمكن أبدًا بيعها بأكثر من طاقتها. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ المتطلبات: WordPress 6.9+، WooCommerce، PHP 7.4+ الترخيص: GPLv2 أو...

CVE-2025-2304

Camaleon CMS v2.9.1 - Mass Assignment leads to Privilege Escalation Exploit Tool - PoC Description This project is a Python-based exploitation proof of concept tool that demonstrates and analyzes a privilege escalation vulnerability affecting v2.9.1 of Camaleon CMS. The script automates the proce...

CVE-2025-2304-CamaleonCMS-PoC

PoC: CVE-2025-2304 - Camaleon CMS Privilege Escalation Technical Overview This repository contains a Functional Proof of Concept PoC for a Mass Assignment vulnerability in Camaleon CMS versions prior to 2.8.1. The vulnerability resides in the updatedajax endpoint of the User Management module,...