CVE-2020-26679

EUVD-2020-19221 · Published May 26, 2021

vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profile description or supply a new profile image. This can lead to potential cross-site scripting attacks on any user, or upload malicious PHP webshells as "profile pictures." The user IDs can be easily determined by other responses from the API for an event or chat room.

Technologies

Vfairs Vfairs

Weaknesses

CWE-639

CVSS scores

v3.14.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
v2.04.0AV:N/AC:L/Au:S/C:N/I:P/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

http://vfairs.com
https://api.vfairs.com/v1/profiles
https://api.vfairs.com/v1/profiles?access_key=
https://www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack

Potentially impacted assets

See if this affects your attack surface