CVE-2025-2304

CVE-2025-2304 - Camaleon CMS 2.9.0 - Privilege Escalation Exploit Overview This Python script exploits a critical mass assignment vulnerability in Camaleon CMS version 2.9.0, allowing any registered user to escalate their privileges to administrator. Vulnerability Details CVE : CVE-2025-2304 - Ma...

CVE-2025-2304-POC

CVE-2025-2304 Privilege Escalation in Camaleon CMS Example python3 exploit.py http://target.com attacker attacker After successful exploitation, logout and login again to gain admin privileges. References https://nvd.nist.gov/vuln/detail/CVE-2025-2304...

CVE-2025-2304-Camaleon-CMS-Mass-Assignment-Privilege-Escalation-PoC

CVE-2025-2304 — Camaleon CMS Mass Assignment Privilege Escalation PoC Privilege escalation vulnerability in Camaleon CMS /updatedajax with passwordrole=admin injected into the password parameters. 4. Verifies the role has been updated to admin. Requirements Python 3 Install dependencies: python3 ...

CVE-2026-56721: Authorization Bypass Through User-Controlled Key

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference IDOR that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action...

Exploit for CVE-2025-2304

Camaleon CMS 2.9.0 – Authenticated Privilege Escalation Role...

Exploit for CVE-2025-2304

PoC: CVE-2025-2304 - Camaleon CMS Privilege Escalation Tec...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the updatedajax method of the...

CVE-2025-2304

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updatedajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without a...

CVE-2025-2304: Improperly Controlled Modification of Dynamically-Determined Object Attributes

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updatedajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without a...