MrCms Vertical Privilege Escalation Vulnerability Allowing Arbitrary User Deletion

A vertical privilege escalation vulnerability has been identified in MrCms version 3.1.2, specifically within the UserController component. This vulnerability allows attackers to delete users arbitrarily by sending a crafted request, without any permission validation. The issue arises because the deletion function can be executed as long as the user ID exists in the system, leaving room for unauthorized user management.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of user accounts.

Reproduction

To reproduce this vulnerability, intercept the request made when clicking the 'Delete' button for a user. The absence of a cookie is not a barrier, as the request can still successfully delete users. This demonstrates that the deletion process lacks proper authorization checks, allowing any user to be removed as long as their ID is provided.