Description
UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send a crafted POST request to /dist/admin/index.php with specific parameters to generate a new admin user with full system access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ulicms | Ulicms | 2023.1 | — |
References
- ExploitDB-51433 exploit
- Archived Product Webpage product
- VulnCheck Advisory: UliCMS 2023.1 Privilege Escalation via Unauthenticated Admin Account Creation third-party-advisory