The document describes a privilege escalation vulnerability in RedaxScript 2.1.0 due to improper access controls and input validation. An attacker can escalate privileges by tampering with the 'groups[]' parameter in an account update request.
Classification
Writeup 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target:RedaxScript 2.1.0
Auth required
Prerequisites:Valid non-admin user account · Access to the account update functionality