CVE-2023-53923
BaseFortify
Publication date: 2025-12-17
Last updated on: 2025-12-18
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ulicms | ulicms | 2023.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for HTTP POST requests to the /dist/admin/index.php endpoint with parameters such as sClass=UserController, sMethod=create, and add_admin=add_admin. A practical detection method is to look for such crafted POST requests in web server logs or by using network monitoring tools. For example, using curl or similar tools to simulate or detect such requests can help. A sample command to test or detect the vulnerability is: curl -X POST http://<target>/dist/admin/index.php -d "sClass=UserController&sMethod=create&add_admin=add_admin&username=admin&first_name=Admin&last_name=User&[email protected]&password=Passw0rd!&password_confirm=Passw0rd!&group_id=1&admin=1" Monitoring for similar requests in logs or network traffic can indicate exploitation attempts. [2]
Can you explain this vulnerability to me?
This vulnerability in UliCMS 2023.1 allows unauthenticated attackers to escalate their privileges by creating administrative accounts. Specifically, attackers can send a crafted POST request to the UserController endpoint (/dist/admin/index.php) with certain parameters, which results in the creation of a new admin user with full system access.
How can this vulnerability impact me? :
The vulnerability can have a severe impact as it allows attackers to gain full administrative access to the system without authentication. This means attackers can control the entire system, potentially leading to data breaches, unauthorized changes, and complete compromise of the affected UliCMS installation.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /dist/admin/index.php endpoint to trusted users only, implementing proper authentication and authorization checks on the UserController endpoint, and applying any available patches or updates from UliCMS. Additionally, monitoring logs for suspicious POST requests and disabling or restricting the vulnerable functionality until a fix is applied can help reduce risk. [1]