CVE-2020-26677
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
SQL injection vulnerability in vFairs 3.3 allows any logged-in user to inject malicious SQL queries into the API. An attacker can manipulate the database of the conference or event.
Risk Assessment
Risk includes unauthorized access to participant data, modification or deletion of event information, and potential system takeover.
Recommendation
Immediately update vFairs to the latest version that includes a fix for this vulnerability. In the meantime, restrict API access to trusted users only.
Other vulnerabilities in vFairs
See all- CVE-2020-26680Medium
In vFairs 3.3, any logged-in user can modify any other user's profile to inject malicious JavaScript (XSS). The database stores HTML tags that are rendered on the page, enabling XSS attacks.
- CVE-2020-26679Medium
vFairs 3.3 is affected by insecure permissions, allowing any logged-in user to modify other users' profile information or pictures. By knowing a user's unique ID, an attacker can send an HTTP POST request to change profile details or upload a new image.
- CVE-2020-26678High
vFairs 3.3 is affected by Remote Code Execution. Any logged-in user can abuse the profile picture upload functionality to place a malicious PHP file on the server and gain code execution.
Original NVD description (English source)
Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the API.