Themesbrand Chatvia Arbitrary Code Execution Vulnerability in User Profile Image Upload

A vulnerability in Themesbrand Chatvia version 5.3.2 allows remote attackers to execute arbitrary code by exploiting the image upload feature in user profiles. The issue arises from improper handling of uploaded files, which can be manipulated to execute malicious code.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Chatvia is hosted.

Reproduction

To reproduce this vulnerability, first upload a file through the user profile image upload function. Then, intercept the upload request and modify the file type and content to include a malicious HTML file with embedded JavaScript. After sending the modified request, the uploaded file can be accessed via its URL, which will execute the embedded JavaScript, demonstrating the successful exploitation of the vulnerability.