CVE-2020-26679
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
vFairs 3.3 is affected by insecure permissions, allowing any logged-in user to modify other users' profile information or pictures. By knowing a user's unique ID, an attacker can send an HTTP POST request to change profile details or upload a new image.
Risk Assessment
The risk includes potential cross-site scripting attacks on any user and the ability to upload malicious PHP webshells as profile pictures, which could lead to account takeover or server compromise.
Recommendation
Update vFairs to the latest version immediately and implement proper authorization checks for all profile modification operations. Additionally, restrict API access and validate uploaded files.
Other vulnerabilities in vFairs
See all- CVE-2020-26680Medium
In vFairs 3.3, any logged-in user can modify any other user's profile to inject malicious JavaScript (XSS). The database stores HTML tags that are rendered on the page, enabling XSS attacks.
- CVE-2020-26678High
vFairs 3.3 is affected by Remote Code Execution. Any logged-in user can abuse the profile picture upload functionality to place a malicious PHP file on the server and gain code execution.
- CVE-2020-26677High
SQL injection vulnerability in vFairs 3.3 allows any logged-in user to inject malicious SQL queries into the API. An attacker can manipulate the database of the conference or event.
Original NVD description (English source)
vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profile description or supply a new profile image. This can lead to potential cross-site scripting attacks on any user, or upload malicious PHP webshells as "profile pictures." The user IDs can be easily determined by other responses from the API for an event or chat room.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS