A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.
The vulnerability occurs in the 'updated_ajax' method of the UsersController, which is called when a user changes their password. Developers used an unsafe 'permit!' method that allows all HTTP request parameters to pass through without any filtering or validation. An attacker can thus submit additional, unauthorized parameters (e.g., related to account role or permissions) that will be accepted and saved by the application.
A logged-in user with low privileges can escalate their privileges to a higher level, potentially gaining administrative access to the application and system data as well as other users' data.
Apply patches available from the vendor according to the references. An additional remediation measure is to replace the 'permit!' method with a strict list of allowed parameters (strong parameters) in the UsersController.
Camaleon CMS — versions indicated in vendor references (https://github.com/owen2345/camaleon-cms)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X