Vvveb Privilege Escalation Vulnerability in Admin User Profile Save Endpoint

A privilege escalation vulnerability has been identified in Vvveb versions prior to 1.0.8.1. This vulnerability allows authenticated users to modify privileged fields in their own admin user profiles. By injecting a specific role_id into profile save requests, users can escalate their privileges to Super Administrator level. This elevated access enables them to upload plugins, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation to Super Administrator rights, including the ability to upload plugins that could execute malicious code remotely.

Remediation

Users can update to Vvveb version 1.0.8.1 or later, where this vulnerability has been fixed.