critical9.8
CVE-2023-53923
UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController …
Impact
UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send a crafted POST request to /dist/admin/index.php with specific parameters to generate a new admin user with full system access.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ulicms | Ulicms | Version 2023.1 |