A flaw in gougucms 4.08.18 allows attackers to manipulate the request payload sent to the registration endpoint, causing the application to set arbitrary object properties dynamically. This mass-assignment vulnerability can lead to code execution or privilege escalation if the attacker crafts input that triggers sensitive logic. The weakness aligns with the mass-assignment category, exposing the application to remote attackers who can trigger the flaw without prior authentication.

The product affected is Gougucms version 4.08.18. No other versions or vendors are listed as vulnerable in the available data. The vulnerability resides in the reg_submit function within app/home/controller/Login.php, which manages user registrations through the web interface.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is not provided and the issue is not catalogued in the KEV list. The likely attack vector is a remote POST request to the /login.php registration endpoint that supplies crafted data. No additional credentials or elevated permissions are required; the function directly processes user-supplied input, making the exploit straightforward once the target is identified.