Executive Summary

This vulnerability in UliCMS 2023.1 allows unauthenticated attackers to escalate their privileges by creating administrative accounts. Specifically, attackers can send a crafted POST request to the UserController endpoint (/dist/admin/index.php) with certain parameters, which results in the creation of a new admin user with full system access.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have a severe impact as it allows attackers to gain full administrative access to the system without authentication. This means attackers can control the entire system, potentially leading to data breaches, unauthorized changes, and complete compromise of the affected UliCMS installation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for HTTP POST requests to the /dist/admin/index.php endpoint with parameters such as sClass=UserController, sMethod=create, and add_admin=add_admin. A practical detection method is to look for such crafted POST requests in web server logs or by using network monitoring tools. For example, using curl or similar tools to simulate or detect such requests can help. A sample command to test or detect the vulnerability is: curl -X POST http://<target>/dist/admin/index.php -d "sClass=UserController&sMethod=create&add_admin=add_admin&username=admin&first_name=Admin&last_name=User&[email protected]&password=Passw0rd!&password_confirm=Passw0rd!&group_id=1&admin=1" Monitoring for similar requests in logs or network traffic can indicate exploitation attempts. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the /dist/admin/index.php endpoint to trusted users only, implementing proper authentication and authorization checks on the UserController endpoint, and applying any available patches or updates from UliCMS. Additionally, monitoring logs for suspicious POST requests and disabling or restricting the vulnerable functionality until a fix is applied can help reduce risk. [1]

Useful 0 Not Useful 0