CyberRota Analysis
AI-GeneratedCamaleonCMS is vulnerable due to a missing authorization flaw that permits authenticated low-privileged users to access and modify settings for several plugins without proper administrative permissions. This vulnerability can lead to significant impacts, including altered cached page behavior and potential account takeover when combined with stored cross-site scripting attacks. Organizations using CamaleonCMS should prioritize patching this vulnerability to protect against unauthorized access and manipulation of their web applications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration parameters at runtime across the attack, front_cache, cama_meta_tag, and cama_contact_form plugins to alter cached page behavior, modify public meta-tag output, or reconfigure contact forms, enabling account takeover when chained with stored cross-site scripting through the contact form's before_html field.