Vvveb vulnerabilities

Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file. This enables attackers to upload .phtml files containing arbitrary PHP code and execute the payload through an unauthenticated HTTP GET request.

Vvveb before version 1.0.8.2 contains an XML external entity (XXE) injection vulnerability in the admin Tools/Import feature that allows authenticated site_admin users to read arbitrary files and modify database records.

Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions.

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials.

Vvveb prior to version 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement, leading to unauthenticated remote code execution as the web server user.

Vvveb before version 1.0.8.4 allows a low-privileged Vendor to access products owned by another Vendor. The product controller does not verify ownership for duplicate and delete actions, enabling reading, duplicating, and deleting products and related data.

Vvveb before version 1.0.8.4 allows a low-privileged Vendor to access revisions for products owned by another Vendor. SQL queries do not verify product ownership for revision reads, restores, and deletes.

Vvveb before version 1.0.8.4 allows a low-privileged Author to access revisions for posts owned by another Author. SQL queries do not verify post ownership for revision lists, reads, restores, and deletes.

Vvveb before version 1.0.8.4 allows a low-privileged Vendor to manage reviews under another Vendor's products. SQL queries do not verify product ownership for reviews.

Vvveb before version 1.0.8.4 allows a low-privileged Vendor to manage questions under another Vendor's products. SQL queries do not verify product ownership for questions.

Vvveb before version 1.0.8.4 has a vulnerability in backend comment operations that allows a low-privileged Author to manage comments under another Author's posts. Lack of ownership verification enables reading comment content, email addresses, changing moderation status, editing or deleting comments.

Vvveb before version 1.0.8.4 has a vulnerability in backend post operations that allows a low-privileged Author to access posts owned by another Author. Lack of consistent ownership enforcement enables viewing metadata, duplicating or deleting posts, potentially exposing private drafts and causing data loss.

Vvveb before version 1.0.8.4 has a vulnerability in backend digital asset operations that allows a low-privileged Vendor to access digital assets linked to another Vendor's products. Lack of ownership boundary enforcement enables listing assets, reading names and file metadata, editing metadata, or deleting asset records.

Vvveb before version 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.

Vvveb before version 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.

Vvveb before version 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps.

Vvveb before version 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer signup flow. The Signup::addUser() controller copies raw POST username values into the display_name field before sanitization, allowing attackers to inject HTML and script markup.

Vvveb before version 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer. Attackers can exploit the 'r' query parameter and '_component_ajax' POST parameter to inject and execute arbitrary JavaScript in the context of the Vvveb origin.

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. Attackers can access the cron controller without authentication and retrieve the exposed secret key from the response, enabling them to trigger scheduled task execution outside of the intended schedule.

Vvveb prior to version 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to bypass MIME type validation by prepending a GIF89a header to HTML/JavaScript payloads, then renaming the file to .html extension. This enables arbitrary JavaScript execution in an administrator's browser session, potentially leading to backdoor account creation and malicious plugin uploads for remote code execution.

Vvveb prior to version 1.0.8.1 contains a server-side request forgery (SSRF) vulnerability in the oEmbedProxy action of the editor/editor module. The url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read arbitrary files readable by the web server process or http:// URLs targeting internal network addresses to probe internal services, with response bodies returned directly to the caller.

Vvveb prior to version 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint. Authenticated users can modify privileged fields on their own profile by injecting role_id=1, escalating to Super Administrator privileges and enabling remote code execution via plugin upload.