Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to escalate privileges by adding any user to any group without proper authorization checks. The vulnerable function lacks CSRF token validation and directly processes user-supplied userId and groupId parameters via getUserManager().createUserInGorup(), enabling malicious websites to forge requests that automatically execute when an authenticated administrator visits a crafted page. Adding a user to the Super Admins group (s2 user) is not possible. Successful exploitation results in the attacker gaining privilege escalation both horizontally to other groups and vertically to the admin group. Escalation to the s2 User group is not possible.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Mura 安全漏洞
Vulnerability Description
Mura是Mura公司的一个内容管理系统。 Mura 10.1.10及之前版本存在安全漏洞，该漏洞源于用户管理中的添加到组功能缺少CSRF令牌验证，可能导致权限提升。
CVSS Information
N/A
Vulnerability Type
N/A