Themesbrand ChatVia Insecure Permissions Vulnerability Allowing Privilege Escalation

A vulnerability in Themesbrand ChatVia version 5.3.2 allows remote attackers to escalate privileges by exploiting insecure permissions in the user profile name and image upload functions.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation.

Reproduction

To reproduce this vulnerability, first capture a request that uploads a profile image. Then, modify the request to change the file type and content to an HTML file containing JavaScript code. After uploading the malicious file, it can be accessed via a URL that is generated by the application.