CVE-2020-26678
HighCVSS 8.8Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
vFairs 3.3 is affected by Remote Code Execution. Any logged-in user can abuse the profile picture upload functionality to place a malicious PHP file on the server and gain code execution.
Risk Assessment
An attacker can take over the server, compromising the confidentiality, integrity, and availability of organizational data and potentially enabling further attacks on the infrastructure.
Recommendation
Immediately update vFairs to the latest version and implement file type validation and upload restrictions on the server.
Other vulnerabilities in vFairs
See all- CVE-2020-26680Medium
In vFairs 3.3, any logged-in user can modify any other user's profile to inject malicious JavaScript (XSS). The database stores HTML tags that are rendered on the page, enabling XSS attacks.
- CVE-2020-26679Medium
vFairs 3.3 is affected by insecure permissions, allowing any logged-in user to modify other users' profile information or pictures. By knowing a user's unique ID, an attacker can send an HTTP POST request to change profile details or upload a new image.
- CVE-2020-26677High
SQL injection vulnerability in vFairs 3.3 allows any logged-in user to inject malicious SQL queries into the API. An attacker can manipulate the database of the conference or event.
Original NVD description (English source)
vFairs 3.3 is affected by Remote Code Execution. Any user logged in to a vFairs virtual conference or event can abuse the functionality to upload a profile picture in order to place a malicious PHP file on the server and gain code execution.