Listen to this Post
How the CVE Works:
The vulnerability exists in the /api/v2/pp_users endpoint of Primakon Pi Portal version 1.0.18. This API handles PATCH requests for user profile updates, including the PP_SECURITY_PROFILE_ID field that defines privilege levels. However, the endpoint lacks proper authorization checks, allowing low-privilege users to modify this field. When a user sends a PATCH request with “PP_SECURITY_PROFILE_ID”: 2 in the JSON body, the system processes it without verifying permissions. The value 2 corresponds to the Administrator role. Due to weak access controls, any authenticated user can exploit this by crafting a simple HTTP request. The server trusts client-supplied data and applies the change, leading to privilege escalation. This is a case of broken access control where server-side validation is missing. The exploit requires only a valid low-level account and network access to the API. Requests can be sent via HTTP clients like curl, making execution easy. The vulnerability allows attackers to gain administrative privileges, compromising system security. It highlights the need for role-based access control and authorization mechanisms on sensitive endpoints.
Platform: Primakon Pi Portal
Version: 1.0.18
Vulnerability: Privilege Escalation
Severity: Critical
Date: 11/25/2025
Prediction: Patch expected 2026
What Undercode Say:
Analytics
curl -X PATCH 'http://target/api/v2/pp_users' -H 'Content-Type: application/json' -H 'Authorization: Bearer token' -d '{"PP_SECURITY_PROFILE_ID":2}'
import requests
response = requests.patch('http://target/api/v2/pp_users', json={'PP_SECURITY_PROFILE_ID':2}, headers={'Authorization':'Bearer token'})
print(response.status_code)
how Exploit:
Authenticate low-privilege user.
Send PATCH request.
Set PP_SECURITY_PROFILE_ID to 2.
Gain administrator access.
Protection from this CVE
Implement authorization checks.
Update to patched version.
Use role-based access control.
Monitor API activity.
Impact:
Full system compromise.
Unauthorized administrative access.
Data breaches possible.
Security hierarchy broken.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
