CVE-2023-53914
CriticalSummary
UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative account with full system access.
Risk Assessment
This vulnerability could lead to complete system takeover by unauthorized users, posing a critical security threat.
Recommendation
It is recommended to immediately update the system to a patched version and to implement proper authorization mechanisms.
Original NVD description (English source)
UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative account with full system access.