vFairs vulnerabilities

In vFairs 3.3, any logged-in user can modify any other user's profile to inject malicious JavaScript (XSS). The database stores HTML tags that are rendered on the page, enabling XSS attacks.

vFairs 3.3 is affected by insecure permissions, allowing any logged-in user to modify other users' profile information or pictures. By knowing a user's unique ID, an attacker can send an HTTP POST request to change profile details or upload a new image.

vFairs 3.3 is affected by Remote Code Execution. Any logged-in user can abuse the profile picture upload functionality to place a malicious PHP file on the server and gain code execution.

SQL injection vulnerability in vFairs 3.3 allows any logged-in user to inject malicious SQL queries into the API. An attacker can manipulate the database of the conference or event.