PT-2025-51952 · Ulicms · Ulicms

Mirabbas Ağalarov · Published 2025-12-17 · Updated 2025-12-24 · CVE-2023-53914

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UliCMS version 2023.1

Description An authentication bypass allows unauthenticated attackers to create administrative users. This is possible through mass assignment in the UserController by sending a crafted POST request to the ''index.php'' endpoint. Successful exploitation grants attackers full system access. The vulnerable parameter is not explicitly mentioned.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-53914

Affected Products

Ulicms

References · 8

• 🔥 https://exploit-db.com/exploits/51486 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53914 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53914 · Vendor Advisory
• https://web.archive.org/web/20230314183734/https://en.ulicms.de · Note
• https://t.me/cveNotify/146782 · Telegram Post
• https://vulncheck.com/advisories/ulicms-authentication-bypass-via-mass-assignment-vulnerability · Note
• https://twitter.com/CVEnew/status/2002487791473865162 · Twitter Post
• https://twitter.com/0dayPublishing/status/2001675247406190815 · Twitter Post