V-SOL GPON/EPON OLT Platform Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in V-SOL GPON/EPON OLT Platform version 2.03. This vulnerability allows normal users to gain administrative access by manipulating the user role parameter. Exploitation involves sending a crafted HTTP POST request to the user management endpoint with the 'user_role_mod' parameter set to '1'. The vulnerability arises because the application does not properly validate user role modifications, enabling unauthorized privilege elevation.

Impact

Exploitation of this vulnerability allows normal users to gain administrative privileges on the affected OLT platform.

Reproduction

To reproduce this vulnerability, send an HTTP POST request to the user management endpoint. Include the 'user_role_mod' parameter set to '1', along with any required user information such as username and password. This can be done manually or through an automated script.