Executive brief
QianFox FoxCMS, a content management system, contains a security flaw in its administrative interface. An attacker with low-level administrative access can exploit this vulnerability to change the passwords of other administrators, including the super administrator. This could lead to a full takeover of the website management system, allowing unauthorized users to modify site content, access sensitive data, or lock out legitimate owners.
Technical details
A privilege escalation vulnerability exists in the 'Edit' function of the 'Admin.php' controller in QianFox FoxCMS up to version 1.2.6. The application fails to perform proper object-level authorization checks when an administrator updates account details. While the code prevents changing the status of the super administrator (ID 1), it does not prevent a lower-privileged administrator from submitting a POST request to '/Admin/edit' with a targeted 'id' and a new 'password'. By manipulating the 'id' parameter, an authenticated attacker can reset the password of any administrator, including the super administrator, leading to full system compromise. As of the advisory date, no official patch has been released.
Affected products
- QianFox FoxCMS up to 1.2.6
Timeline
- 2026-05-03: disclosed: Issue reported on GitHub repository
- 2026-05-27: advisory: CVE published and NVD entry created