Vvveb 1.0.8 File Upload to Stored XSS and RCE via Admin Account Creation

Vvveb 1.0.8 XSS Leading to Admin Backdoor Account Creation Vulnerability Summary Vulnerability Overview This vulnerability exists in Vvveb version 1.0.8. Users with and permissions can upload a GIF file containing malicious HTML content, then rename it to and execute malicious JavaScript code. This results in the creation of a backdoor account with full administrator privileges. An administrator uploading a plugin containing malicious PHP code can lead to remote code execution (RCE). CVSS v3.1 Score: 9.0 (Critical) Attack Chain: 1. Low-privilege user (Vendor) uploads a GIF polyglot (bypassing MIME checks). 2. Renames it to (no extension restrictions). 3. Administrator clicks the link (Stored XSS triggers). 4. Backdoor admin account is silently created. 5. Attacker logs in as administrator. 6. Uploads a malicious PHP plugin. 7. Remote code execution occurs. Impact Scope Affected Version: Vvveb 1.0.8 Privilege Requirement: Low (only a restricted vendor account needed) Attack Vector: Network (remotely exploitable via web admin panel) User Interaction: Required (administrator must click the malicious link) CWE Classifications: CWE-434: Unrestricted Upload of File with Dangerous Type CWE-79: Stored Cross-Site Scripting (XSS) CWE-183: Permissive Whitelist of Allowed Inputs CWE-94: Improper Control of Generation of Code (via plugin RCE) Mitigations 1. Use an Allow List: Only allow extensions such as , and enforce this during both upload and rename operations. 2. Apply MIME Validation: Add checks in the rename path to ensure target file safety. 3. Validate File Content: Check that file content matches its extension; reject files containing or files containing . 4. Restrict Rename Endpoint: Disallow changing extensions, or apply a full upload validation pipeline. 5. Set Restrictive Response Headers: For user-uploaded files, set and . 6. Nginx Hardening: In the media directory configuration, add directives such as to prevent HTML rendering. Exploit PoC (Proof of Concept) 1. Account Permission Configuration Screenshot (Create an account with and permissions) 2. Automated Exploit Script ( ) 3. Execution Command 4. Example Execution Output Exploitation Method**: Send the generated XSS payload link to the administrator to create a backdoor account.

Goal Reached Thanks to every supporter — we hit 100%!

Vvveb 1.0.8 File Upload to Stored XSS and RCE via Admin Account Creation