Privilege Escalation in Apache OFBiz updateOrRemove Authorization Bypass

Repository contains a README plus two Bash scripts implementing a practical Apache OFBiz exploit chain. The main vulnerability is CVE-2026-47342, a privilege-escalation flaw in OFBiz where an authenticated low-privileged user with ordermgr access can reach /ordermgr/control/updateFeatures, which dispatches to the content service updateOrRemove without adequate authorization checks. By supplying entityName=UserLoginSecurityGroup and fields for userLoginId/groupId/fromDate, the exploit creates a security-group membership record and grants FULLADMIN to the attacker-controlled account. Repository structure: README.md documents the root cause, affected OFBiz files, source-to-sink trace, and mitigation ideas. create_buyer_user.sh is a helper script that logs into /webtools/control/login using hardcoded default admin credentials (admin/ofbiz), creates a test user, and assigns BUYER/ORDERPURCH permissions via entity-change endpoints. poc_fullchain.sh is the primary exploit entry point: it logs into ordermgr as the low-privileged user, posts the crafted updateFeatures request to add FULLADMIN, then logs into webtools and performs a second-stage RCE by creating a Content record and invoking /webtools/control/scheduleServiceSync with SERVICE_NAME=traverseContent and a Groovy expression in pickWhen that launches sh -c <command> and writes output to a temporary file. Capabilities: authenticated privilege escalation to FULLADMIN; helper automation for provisioning a test BUYER account; chained authenticated remote command execution when the target is also vulnerable to the referenced traverseContent/Groovy issue. The exploit is operational rather than framework-based: it uses curl, hardcoded endpoint paths, and a basic shell-command payload with limited customization through script arguments and TARGET environment variable.