GHSA-58rj-4cxx-rrhwHighCVSS 8.8
Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows...
🔗 CVE IDs covered (1)
📋 Description
Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and execute them from the uploads directory to achieve remote code execution.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2019-25758
- https://extensions.joomla.org/extensions/extension/marketing/crm/vbizz
- https://www.exploit-db.com/exploits/46224
- https://www.vulncheck.com/advisories/joomla-component-vbizz-remote-code-execution
- http://wdmtech.com
- https://github.com/advisories/GHSA-58rj-4cxx-rrhw