Listen to this Post
The vulnerability in Grav’s Admin plugin arises from a flawed user creation mechanism that does not enforce username uniqueness. When a user with the ‘create user’ permission attempts to add a new account, the system fails to check if the username already exists in the database. This allows the attacker to specify the username of an existing administrator account. During the creation process, the plugin overwrites the email address associated with the existing username with the new one provided by the attacker. Additionally, a new password is set for this account. Consequently, the original administrator’s credentials are effectively changed without authorization. The attacker can then log in using the compromised username and the newly set password, gaining full administrative privileges. This bypasses all intended access controls, as the system incorrectly treats the new user entry as an update or replacement rather than a duplicate. The issue is rooted in the account creation logic within the Admin plugin’s user management module, where validation steps omit checks for existing usernames. This oversight enables privilege escalation from a low-privileged user account to complete system control, compromising the entire Grav CMS instance.
Platform: Grav Admin Plugin
Version: Not specified
Vulnerability: Privilege Escalation
Severity: Critical
date: Not disclosed
Prediction: No patch date
What Undercode Say:
Showing bash commands and codes related to the blog
git clone https://github.com/user-attachments/assets/3ab0a7d6-5055-41be-9e0e-2bd6ca359b37 cd PoC-directory curl -X POST /grav-admin/admin/accounts/users -d "username=admin&password=attacker_set"
how Exploit:
Navigate to /grav-admin/admin/accounts/users as a user with create permissions. Click “Add” and input an existing admin’s username with a new email and password. Submit the form to overwrite admin credentials. Log out and log in using the new credentials as admin.
Protection from this CVE
Implement username uniqueness validation during user creation. Apply patches from official Grav releases. Restrict create user permissions to trusted admins only.
Impact:
Full admin takeover. Credential modification. Plugin manipulation. Site data compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
