CVE-2020-26679
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
vFairs 3.3 is affected by insecure permissions, allowing any logged-in user to modify other users' profile information or pictures. By knowing a user's unique ID, an attacker can send an HTTP POST request to change profile details or upload a new image.
Risk Assessment
The risk includes potential cross-site scripting attacks on any user and the ability to upload malicious PHP webshells as profile pictures, which could lead to account takeover or server compromise.
Recommendation
Update vFairs to the latest version immediately and implement proper authorization checks for all profile modification operations. Additionally, restrict API access and validate uploaded files.
Original NVD description (English source)
vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profile description or supply a new profile image. This can lead to potential cross-site scripting attacks on any user, or upload malicious PHP webshells as "profile pictures." The user IDs can be easily determined by other responses from the API for an event or chat room.