CVE-2023-53923
CriticalSummary
UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send a crafted POST request to /dist/admin/index.php with specific parameters to generate a new admin user with full system access.
Risk Assessment
This vulnerability could lead to complete system takeover by unauthorized users, posing a critical security threat.
Recommendation
It is recommended to immediately update the system to a patched version and to restrict access to the admin panel.
Original NVD description (English source)
UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send a crafted POST request to /dist/admin/index.php with specific parameters to generate a new admin user with full system access.