Vulnerability Description
Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and execute them from the uploads directory to achieve remote code execution.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wdmtech | Vbizz | <= 1.0.7 |
Related Weaknesses (CWE)
References
- http://wdmtech.com/Product
- https://extensions.joomla.org/extensions/extension/marketing/crm/vbizz/Product
- https://www.exploit-db.com/exploits/46224Exploit
- https://www.vulncheck.com/advisories/joomla-component-vbizz-remote-code-executioThird Party Advisory
FAQ
What is CVE-2019-25758?
CVE-2019-25758 is a vulnerability with a CVSS score of 8.8 (HIGH). Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic...
How severe is CVE-2019-25758?
CVE-2019-25758 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-25758?
Check the references section above for vendor advisories and patch information. Affected products include: Wdmtech Vbizz.