PT-2025-51952 · Ulicms · Ulicms

Mirabbas Ağalarov · Publicado 2025-12-17 · Atualizado 2025-12-24 · CVE-2023-53914

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UliCMS version 2023.1

Description An authentication bypass allows unauthenticated attackers to create administrative users. This is possible through mass assignment in the UserController by sending a crafted POST request to the ''index.php'' endpoint. Successful exploitation grants attackers full system access. The vulnerable parameter is not explicitly mentioned.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-53914

Produtos afetados

Ulicms

Referências · 8

• 🔥 https://exploit-db.com/exploits/51486 · Exploit
• https://web.archive.org/web/20230314183734/https://en.ulicms.de · Nota
• https://t.me/cveNotify/146782 · Publicação no Telegram
• https://vulncheck.com/advisories/ulicms-authentication-bypass-via-mass-assignment-vulnerability · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-53914 · Nota de Segurança
• https://twitter.com/CVEnew/status/2002487791473865162 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-53914 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2001675247406190815 · Publicação no Twitter