Owen2345
Monthly
Camaleon CMS releases before 2.9.2 enforce only authentication, not authorization, on the Admin::MediaController endpoints that handle uploads, private file downloads, cropping and media actions, letting any logged-in user whose role lacks the media manager permission reach those functions by direct URL or POST. A low-privileged authenticated attacker can therefore store files via /admin/media/upload, read private media through download_private_file, and use crop with saved_avatar to alter other users' avatars, producing a high confidentiality impact with limited integrity impact. The vendor has released 2.9.2 with a centralized before_action check, so no public exploit code or active exploitation is indicated in the available data; the CVSS 4.0 base score is 7.1 and priority is this_week, reflecting a real but not emergency-grade issue given the authenticated-account prerequisite.
Camaleon CMS releases before 2.9.3 let an authenticated user who holds only the 'media' permission escape the site's temporary upload directory and write arbitrary files, which can be escalated to remote code execution. The concrete route is the crop_url media action: the attacker submits a base64 'data:' URI together with a name parameter containing ../ sequences, and the pre-2.9.3 upload sink stores the decoded payload at the traversed path - including an ERB template placed inside a theme's views directory, which executes when that view is rendered. The only gate is possession of the media permission, which confines the issue to users already granted upload rights rather than anonymous visitors; the vendor has shipped a fix in 2.9.3 and no public exploit has been identified at time of analysis, though the flaw warrants prompt remediation this week.
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag, and cama_contact_form - to any authenticated low-privileged user, entirely bypassing administrator-level access controls. An attacker holding a standard account can modify live plugin configurations, including injecting arbitrary HTML into the contact form's before_html field to plant a persistent XSS payload. When chained, this broken access control enables full account takeover by stealing an administrator session token; a vendor patch is available and no public exploit has been identified at time of analysis.
Stored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist arbitrary HTML/JavaScript via the unsanitized before_html field on the contact-form edit endpoint, which lacks proper authorization checks. The payload executes in the browser of anyone who loads the contact form - including administrators - enabling cookie theft, forged authenticated requests, and session takeover. Reported by VulnCheck with a public technical writeup; no public working exploit code and no active exploitation are confirmed at time of analysis.
Authenticated SQL injection in CamaleonCMS 2.9.1 allows low-privileged users holding post creation or editing rights to extract sensitive data - including administrative credentials and configuration values - from the underlying SQLite database via crafted slug payloads. The flaw exists because the post slug field is incorporated into backend database queries without adequate parameterization, enabling boolean- and union-based blind injection techniques over a standard network-accessible web interface. A vendor patch is available via the upstream GitHub repository; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote code execution by embedding ERB expressions in the email parameter of the admin test_email endpoint. When SMTP rejects the crafted recipient address, Rails renders the rejection exception message as an inline ERB template, evaluating attacker-controlled Ruby code as the Rails process user. A patch is available from the vendor; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.5 reflects high confidentiality, integrity, and availability impact constrained by the admin-only prerequisite and the SMTP-rejection triggering condition.
Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a malicious HTML/JavaScript payload as a draft post title, which executes in an administrator's browser when the admin views the drafts listing. Because the payload runs in the admin's authenticated session, it enables session/cookie theft and forged administrative requests, effectively escalating a low-privileged account to admin-level control. Reported by VulnCheck with a public technical write-up; no public exploit identified at time of analysis and not listed in CISA KEV.
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administrator passwords and achieve full site takeover via a parameter confusion flaw in the UsersController's updated_ajax endpoint. The authorization filter and the action body each resolve the target user from a different parameter key, enabling an attacker to pass their own ID to satisfy the self-authorization check while simultaneously directing the mutation at any victim account. No public exploit tool has been identified at time of analysis, but the upstream fix commit is available on GitHub (PR #1185, commit 2634503), with a formally tagged patched release not yet independently confirmed.
Authenticated remote code execution in Camaleon CMS 2.1.1 through 2.9.1 lets users who hold the custom_fields manage permission store an arbitrary Ruby expression in the 'command' option of a select_eval custom field, which is then evaluated via instance_eval inside an ERB view whenever a post edit page is rendered, yielding code execution with web-server process privileges. Publicly available exploit code exists (including a public proof-of-concept repository and writeup), but the flaw is not listed in CISA KEV and EPSS is modest at 0.74% (51st percentile), so practical risk concentrates on installations that delegate custom-field management to non-administrative roles. The vulnerability requires an authenticated principal with that permission (CVSS vector PR:L), and is not reachable by anonymous users.
Category-management authorization bypass in Camaleon CMS before 2.9.2 lets an authenticated low-privileged user rename or delete categories belonging to a different post type by pairing their own authorized post_type_id with an arbitrary category ID in update or destroy requests. The flaw is an insecure direct object reference (CWE-639) in Admin::CategoriesController with medium severity impact limited to integrity and availability of category objects; it does not disclose data or enable code execution. Vendor-released patch 2.9.2 is available, and no public exploit code was identified at time of analysis.
Object-level authorization bypass in owen2345 Camaleon CMS through 2.9.2 lets an authenticated user who holds only the media-library permission (`:manage, :media`) overwrite another user's avatar by calling the admin media crop endpoint with the `saved_avatar` parameter set to a victim's user ID. The crop action reaches the same avatar meta write that `UsersController#update` protects with `:manage, :users`, but enforces only the media permission, so the media library becomes a side door into profile editing; post-PR-#1267 the target is scoped to `current_site.users`, limiting the bypass to same-site, cross-user writes rather than cross-tenant ones. Publicly available exploit code exists (CVSS 4.0 vector carries E:P), and the vendor has released a fix in 2.9.3; the exposure is limited to profile-meta tampering with no access to passwords, credentials, or confidential data, so the assessed risk is genuinely low. No confirmed active exploitation (CISA KEV) was identified at time of analysis.
Server-side request forgery in Camaleon CMS 2.7.5-2.9.1 allows authenticated users to abuse the media library's 'Upload from URL' feature to reach internal network services. The root cause is Ruby's OpenURI library transparently following HTTP redirects, so a URL that passes initial host validation can redirect to an internal address (cloud metadata endpoints, internal APIs) that the server then fetches and returns. Version 2.9.2 patches the issue with a redirect-blocking download helper; no public exploit or CISA KEV listing has been identified.
Insecure Direct Object Reference in CamaleonCMS 2.9.2 and earlier allows any authenticated user to enumerate and read profile data belonging to any other user, including administrators. The Admin::UsersController#profile action was explicitly excluded from the validate_role authorization filter with no compensating ownership check, meaning a low-privilege 'client' role account can supply an arbitrary integer user_id query parameter to GET /admin/profile and receive the target user's email, username, role, and custom field data. No public exploit has been identified at time of analysis, but the attack requires only a valid session and a loop over sequential integer IDs.
Draft post creation in Camaleon CMS through 2.9.2 allows any authenticated low-privileged user to create and overwrite draft posts by bypassing role and permission checks on the admin drafts endpoint. The DraftsController's overridden create and update actions omitted the authorize! calls enforced by the parent PostsController, and used global unscoped post lookups that ignore post type and user ownership, enabling cross-post-type draft manipulation and ownership attribution changes on existing drafts. No CISA KEV listing or public exploit code has been identified; the CVSS 4.0 score of 5.3 (PR:L, VI:L) reflects limited integrity impact with no confidentiality or availability consequence.
Camaleon CMS releases before 2.9.2 enforce only authentication, not authorization, on the Admin::MediaController endpoints that handle uploads, private file downloads, cropping and media actions, letting any logged-in user whose role lacks the media manager permission reach those functions by direct URL or POST. A low-privileged authenticated attacker can therefore store files via /admin/media/upload, read private media through download_private_file, and use crop with saved_avatar to alter other users' avatars, producing a high confidentiality impact with limited integrity impact. The vendor has released 2.9.2 with a centralized before_action check, so no public exploit code or active exploitation is indicated in the available data; the CVSS 4.0 base score is 7.1 and priority is this_week, reflecting a real but not emergency-grade issue given the authenticated-account prerequisite.
Camaleon CMS releases before 2.9.3 let an authenticated user who holds only the 'media' permission escape the site's temporary upload directory and write arbitrary files, which can be escalated to remote code execution. The concrete route is the crop_url media action: the attacker submits a base64 'data:' URI together with a name parameter containing ../ sequences, and the pre-2.9.3 upload sink stores the decoded payload at the traversed path - including an ERB template placed inside a theme's views directory, which executes when that view is rendered. The only gate is possession of the media permission, which confines the issue to users already granted upload rights rather than anonymous visitors; the vendor has shipped a fix in 2.9.3 and no public exploit has been identified at time of analysis, though the flaw warrants prompt remediation this week.
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag, and cama_contact_form - to any authenticated low-privileged user, entirely bypassing administrator-level access controls. An attacker holding a standard account can modify live plugin configurations, including injecting arbitrary HTML into the contact form's before_html field to plant a persistent XSS payload. When chained, this broken access control enables full account takeover by stealing an administrator session token; a vendor patch is available and no public exploit has been identified at time of analysis.
Stored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist arbitrary HTML/JavaScript via the unsanitized before_html field on the contact-form edit endpoint, which lacks proper authorization checks. The payload executes in the browser of anyone who loads the contact form - including administrators - enabling cookie theft, forged authenticated requests, and session takeover. Reported by VulnCheck with a public technical writeup; no public working exploit code and no active exploitation are confirmed at time of analysis.
Authenticated SQL injection in CamaleonCMS 2.9.1 allows low-privileged users holding post creation or editing rights to extract sensitive data - including administrative credentials and configuration values - from the underlying SQLite database via crafted slug payloads. The flaw exists because the post slug field is incorporated into backend database queries without adequate parameterization, enabling boolean- and union-based blind injection techniques over a standard network-accessible web interface. A vendor patch is available via the upstream GitHub repository; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote code execution by embedding ERB expressions in the email parameter of the admin test_email endpoint. When SMTP rejects the crafted recipient address, Rails renders the rejection exception message as an inline ERB template, evaluating attacker-controlled Ruby code as the Rails process user. A patch is available from the vendor; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.5 reflects high confidentiality, integrity, and availability impact constrained by the admin-only prerequisite and the SMTP-rejection triggering condition.
Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a malicious HTML/JavaScript payload as a draft post title, which executes in an administrator's browser when the admin views the drafts listing. Because the payload runs in the admin's authenticated session, it enables session/cookie theft and forged administrative requests, effectively escalating a low-privileged account to admin-level control. Reported by VulnCheck with a public technical write-up; no public exploit identified at time of analysis and not listed in CISA KEV.
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administrator passwords and achieve full site takeover via a parameter confusion flaw in the UsersController's updated_ajax endpoint. The authorization filter and the action body each resolve the target user from a different parameter key, enabling an attacker to pass their own ID to satisfy the self-authorization check while simultaneously directing the mutation at any victim account. No public exploit tool has been identified at time of analysis, but the upstream fix commit is available on GitHub (PR #1185, commit 2634503), with a formally tagged patched release not yet independently confirmed.
Authenticated remote code execution in Camaleon CMS 2.1.1 through 2.9.1 lets users who hold the custom_fields manage permission store an arbitrary Ruby expression in the 'command' option of a select_eval custom field, which is then evaluated via instance_eval inside an ERB view whenever a post edit page is rendered, yielding code execution with web-server process privileges. Publicly available exploit code exists (including a public proof-of-concept repository and writeup), but the flaw is not listed in CISA KEV and EPSS is modest at 0.74% (51st percentile), so practical risk concentrates on installations that delegate custom-field management to non-administrative roles. The vulnerability requires an authenticated principal with that permission (CVSS vector PR:L), and is not reachable by anonymous users.
Category-management authorization bypass in Camaleon CMS before 2.9.2 lets an authenticated low-privileged user rename or delete categories belonging to a different post type by pairing their own authorized post_type_id with an arbitrary category ID in update or destroy requests. The flaw is an insecure direct object reference (CWE-639) in Admin::CategoriesController with medium severity impact limited to integrity and availability of category objects; it does not disclose data or enable code execution. Vendor-released patch 2.9.2 is available, and no public exploit code was identified at time of analysis.
Object-level authorization bypass in owen2345 Camaleon CMS through 2.9.2 lets an authenticated user who holds only the media-library permission (`:manage, :media`) overwrite another user's avatar by calling the admin media crop endpoint with the `saved_avatar` parameter set to a victim's user ID. The crop action reaches the same avatar meta write that `UsersController#update` protects with `:manage, :users`, but enforces only the media permission, so the media library becomes a side door into profile editing; post-PR-#1267 the target is scoped to `current_site.users`, limiting the bypass to same-site, cross-user writes rather than cross-tenant ones. Publicly available exploit code exists (CVSS 4.0 vector carries E:P), and the vendor has released a fix in 2.9.3; the exposure is limited to profile-meta tampering with no access to passwords, credentials, or confidential data, so the assessed risk is genuinely low. No confirmed active exploitation (CISA KEV) was identified at time of analysis.
Server-side request forgery in Camaleon CMS 2.7.5-2.9.1 allows authenticated users to abuse the media library's 'Upload from URL' feature to reach internal network services. The root cause is Ruby's OpenURI library transparently following HTTP redirects, so a URL that passes initial host validation can redirect to an internal address (cloud metadata endpoints, internal APIs) that the server then fetches and returns. Version 2.9.2 patches the issue with a redirect-blocking download helper; no public exploit or CISA KEV listing has been identified.
Insecure Direct Object Reference in CamaleonCMS 2.9.2 and earlier allows any authenticated user to enumerate and read profile data belonging to any other user, including administrators. The Admin::UsersController#profile action was explicitly excluded from the validate_role authorization filter with no compensating ownership check, meaning a low-privilege 'client' role account can supply an arbitrary integer user_id query parameter to GET /admin/profile and receive the target user's email, username, role, and custom field data. No public exploit has been identified at time of analysis, but the attack requires only a valid session and a loop over sequential integer IDs.
Draft post creation in Camaleon CMS through 2.9.2 allows any authenticated low-privileged user to create and overwrite draft posts by bypassing role and permission checks on the admin drafts endpoint. The DraftsController's overridden create and update actions omitted the authorize! calls enforced by the parent PostsController, and used global unscoped post lookups that ignore post type and user ownership, enabling cross-post-type draft manipulation and ownership attribution changes on existing drafts. No CISA KEV listing or public exploit code has been identified; the CVSS 4.0 score of 5.3 (PR:L, VI:L) reflects limited integrity impact with no confidentiality or availability consequence.