PT-2021-11259 · Vfairs · Vfairs

John Hammond · Published 2021-05-26 · Updated 2022-07-12 · CVE-2020-26679

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: vFairs version 3.3

Description: The issue allows any logged-in user to modify other users' profile information or profile picture in a vFairs virtual conference or event. By obtaining a user's unique identification number and their own, an attacker can make an HTTP POST request to update the profile description or supply a new profile image. This could lead to potential cross-site scripting attacks on any user or allow the upload of malicious PHP webshells as "profile pictures." The user IDs can be easily determined from other API responses for an event or chat room.

Recommendations: For vFairs version 3.3, consider restricting access to profile modification features until a proper fix is implemented to prevent unauthorized changes. As a temporary workaround, restrict the ability to update profile descriptions or upload new profile images to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2020-26679

Affected Products

Vfairs

References · 6

• http://vfairs.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26679 · Security Note
• https://api.vfairs.com/v1/profiles · Vendor Advisory
• https://api.vfairs.com/v1/profiles?access_key= · Vendor Advisory
• https://huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack · Note