Basant Kumar

Vvveb before 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer signup flow where the Signup::addUser() controller copies raw POST username values into the display name field before sanitization occurs. Attackers can submit HTML and script markup in the username field during signup, which gets stripped from the username column but persisted verbatim in the display name column, allowing stored XSS execution when display name is rendered without encoding in vulnerable views.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.3 **Description** An unrestricted file upload issue exists in the plugin upload endpoint. This allows users with super admin privileges to execute arbitrary PHP code by uploading a malicious plugin ZIP file. The attack involves crafting a ZIP archive containing a `plugin.php` file with a valid Slug header and a `public/index.php` file containing arbitrary PHP code. This code executes with the permissions of the web server user when accessed through unauthenticated HTTP requests to the public path of the plugin. **Recommendations** Update to version 1.0.8.3 or later.

Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.

Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** An information disclosure issue exists in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. By accessing the cron controller without authentication, an attacker can obtain the exposed secret key from the response, which enables the triggering of scheduled task execution outside of the intended schedule. **Recommendations** Update to version 1.0.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** An unauthenticated reflected cross-site scripting issue exists in the visual editor preview renderer. Attackers can execute arbitrary JavaScript by manipulating the `r` query parameter and ` component ajax` POST parameter. This occurs because the `isEditor()` function does not perform session, role, or token verification, and the view handler injects raw HTML POST body content without sanitization. Attackers can use a malicious link or an auto-submitted form to execute controlled JavaScript within the context of the Vvveb origin. **Recommendations** Update to version 1.0.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** An information disclosure issue allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. By accessing the admin password-reset endpoint, a fatal error is triggered due to a missing namespace import. This exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler. **Recommendations** Update to version 1.0.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** An unrestricted file upload issue exists in the media upload handler. Authenticated users with media-upload permissions can bypass extension restrictions by uploading a `.htaccess` file to map `.phtml` extensions to the PHP handler. This allows the upload of a `.phtml` file containing arbitrary PHP code, which can be executed by sending an unauthenticated HTTP GET request to the uploaded file, leading to remote code execution with web server privileges. **Recommendations** Update to version 1.0.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** An XML external entity (XXE) injection issue exists in the admin Tools/Import feature. Authenticated `site admin` users can exploit the XML parser configuration in the 'system/import/xml.php' endpoint to inject `file://` or `php://filter` entity references. These references are resolved and persisted into the application database, allowing for arbitrary file disclosure and the overwriting of administrator password hashes to achieve privilege escalation. **Recommendations** Update to version 1.0.8.2 or later. As a temporary workaround, restrict access to the 'system/import/xml.php' endpoint.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** The admin code editor allows authenticated users with low privileges, such as editor, author, contributor, or site admin roles, to execute arbitrary code. This is possible due to insufficient file extension restrictions, enabling attackers to write a malicious `.htaccess` file to map arbitrary extensions to the PHP handler. Subsequently, PHP code can be uploaded using those extensions to achieve remote code execution when the file is accessed via HTTP. **Recommendations** Update to version 1.0.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** A hard-coded credentials issue exists in the `docker-compose-apache.yaml` configuration. This allows unauthenticated attackers to access the bundled phpMyAdmin container using pre-configured database credentials. By connecting to the phpMyAdmin port, attackers can obtain unrestricted read and write access to the entire database, including administrator password hashes, customer personally identifiable information, and order data, which can lead to account takeover and data manipulation. **Recommendations** Update to version 1.0.8.2 or later.