PiHome Role-Based Access Control Vulnerability Allowing Unauthorized Admin Account Creation

A critical vulnerability exists in PiHome HVAC version 2.0, specifically within the role-based access control component. The issue is located in the '/user_accounts.php?uid' file, where the application fails to properly authorize users before allowing account creation. This flaw enables any authenticated user, regardless of their privilege level, to create new admin accounts. The vulnerability can be exploited remotely and has been publicly disclosed.

Impact

Exploitation of this vulnerability allows any authenticated user to create admin accounts, potentially leading to full system compromise.

Reproduction

To reproduce this vulnerability, first set up the PiHome HVAC project. Then, use a tool like cURL or Burp Suite to send a POST request to the '/user_accounts.php?uid' endpoint. Include the necessary cookies and form data to create a new account, specifying administrative privileges.

Remediation

To address this vulnerability, implement role-based access control to ensure only admin users can create new admin accounts. Enforce authorization checks before processing account creation requests, and audit and log account creation actions for review.