UliCMS Authentication Bypass Vulnerability Allowing Unauthenticated Admin User Creation

An authentication bypass vulnerability has been identified in UliCMS version 2023.1. This vulnerability allows unauthenticated attackers to create admin users by exploiting mass assignment in the UserController. By sending a crafted POST request to the admin index.php endpoint with specific parameters, attackers can generate an administrative account with full system access.

Impact

Exploitation of this vulnerability allows for unauthorized creation of admin accounts, granting full system access to the attackers.

Reproduction

To reproduce this vulnerability, send a POST request to the admin index.php endpoint. Include parameters such as 'sClass' set to 'UserController', 'sMethod' set to 'create', and 'add_admin' set to 'add_admin'. Additionally, provide a username, first name, last name, email, password, and group ID. The request must be made without authentication.