Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-25758. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary This exploit demonstrates a file upload vulnerability in Joomla! Component vBizz 1.0.7, allowing remote code execution by uploading a malicious PHP file via a crafted POST request. The uploaded file is then accessed to execute arbitrary code.
Description
Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and execute them from the uploads directory to achieve remote code execution.
Exploits (1)
This exploit demonstrates a file upload vulnerability in Joomla! Component vBizz 1.0.7, allowing remote code execution by uploading a malicious PHP file via a crafted POST request. The uploaded file is then accessed to execute arbitrary code.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H