Camaleon CMS Vulnerability Advisory: Authenticated RCE, SSTI, Stored XSS, SQL Injection, and Access Control Issues

Vulnerability Overview 1. Authenticated RCE via Description: In , there is a custom field option named that evaluates Ruby code. By crafting a specific POST request, Remote Code Execution (RCE) can be triggered. Impact Scope: Administrator privileges are required to exploit this vulnerability. Remediation: Avoid using the option, or implement strict input validation and filtering. 2. Broken Access Control on Admin Endpoints Description: Low-privileged users can access certain administrative endpoints, leading to privilege escalation. Impact Scope: Low-privileged users can access administrative functions, potentially resulting in data leakage or system compromise. Remediation: Strengthen access control to ensure only administrators can access specific endpoints. 3. Stored XSS in Contact Form Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the plugin. Attackers can store malicious scripts in the database by submitting a crafted form. These scripts are executed when other users view the affected page. Impact Scope: Any user accessing the affected page may be compromised. Remediation: Perform strict HTML encoding and validation on user input to prevent malicious script injection. 4. SQL Injection in Post Slug Description: A SQL injection vulnerability exists in the field when creating posts. Attackers can execute arbitrary SQL commands by crafting specific values. Impact Scope: This could lead to database data leakage or tampering. Remediation: Use parameterized queries for the field to avoid direct SQL string concatenation. 5. SSTI via in Leading to RCE Description: A Server-Side Template Injection (SSTI) vulnerability exists in the settings. Attackers can execute arbitrary Ruby code by crafting specific email templates. Impact Scope: This may lead to Remote Code Execution, resulting in complete server compromise. Remediation: Strictly validate email templates to prevent the execution of user-provided template code. 6. Stored XSS via Draft Post Title Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the titles of draft posts. Attackers can store malicious scripts in the database by crafting malicious titles. These scripts are executed when other users view the post. Impact Scope: Any user accessing the affected post may be compromised. Remediation: Perform strict HTML encoding and validation on user input to prevent malicious script injection. 7. Authenticated RCE via Description: A Remote Code Execution (RCE) vulnerability exists in the option. Attackers can trigger RCE by crafting a specific POST request. Impact Scope: Administrator privileges are required to exploit this vulnerability. Remediation: Avoid using the option, or implement strict input validation and filtering. Impact Scope Overall Impact: The aforementioned vulnerabilities may lead to serious consequences such as Remote Code Execution, data leakage, and privilege escalation, significantly compromising the security and stability of the system. Remediation Measures General Recommendations: - Strictly validate and filter all user inputs to prevent malicious code injection. - Strengthen access control to ensure only authorized users can access specific features. - Regularly update and patch the system to fix known vulnerabilities. - Use parameterized queries to prevent SQL injection. - HTML-encode user inputs to prevent XSS attacks. POC Code 1. Authenticated RCE via 2. Stored XSS in Contact Form 3. SQL Injection in Post Slug 4. SSTI via in Leading to RCE 5. Stored XSS via Draft Post Title 6. Authenticated RCE via Summary This document details multiple vulnerabilities in , including Remote Code Execution, Stored XSS, SQL Injection, and Server-Side Template Injection. Each vulnerability includes specific exploitation methods and remediation advice, emphasizing the importance of strengthening input validation and access control.

Goal Reached Thanks to every supporter — we hit 100%!

Camaleon CMS Vulnerability Advisory: Authenticated RCE, SSTI, Stored XSS, SQL Injection, and Access Control Issues