Joomla! Component vBizz 1.0.7 Remote Code Execution
Description
Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and execute them from the uploads directory to achieve remote code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"Unrestricted file upload in the profile_pic parameter allows arbitrary PHP files to be saved and executed."
Attack vector
An authenticated attacker sends a POST request to `index.php?option=com_vbizz&view=employee` with a multipart form containing the `profile_pic` field set to a PHP file (e.g., `phpinfo.php`). The component stores the uploaded file under `components/com_vbizz/uploads/profile_pics/` without any extension or content-type validation [ref_id=1]. The attacker then directly requests the uploaded PHP file, which the server executes, achieving remote code execution.
Affected code
The vulnerability resides in the Joomla! vBizz component (version 1.0.7). The `profile_pic` parameter in the employee view (`index.php?option=com_vbizz&view=employee`) accepts file uploads without validating the file type, allowing arbitrary PHP files to be written to the `components/com_vbizz/uploads/profile_pics/` directory.
What the fix does
No patch is available in the bundle. The advisory does not include a vendor fix or commit diff. To remediate the issue, the component must validate uploaded file extensions (e.g., allow only image types), verify MIME types server-side, and store uploads outside the web root or in a directory with script execution disabled.
Preconditions
- authThe attacker must have a valid Joomla! session (authenticated user)
- configThe vBizz component must be installed and the employee view must be accessible
- configThe uploads directory must be writable and PHP execution must be enabled
Reproduction
Send a POST request to `http://localhost/[PATH]/index.php?option=com_vbizz&view=employee` with a multipart body containing `profile_pic` set to a PHP file (e.g., `phpinfo.php` with `<?php phpinfo(); ?>`). After the server responds with a 303 redirect, request the uploaded file at `http://localhost/[PATH]/components/com_vbizz/uploads/profile_pics/1548192100phpinfo.php` to execute the PHP code [ref_id=1].
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- www.exploit-db.com/exploits/46224mitreexploit
- www.vulncheck.com/advisories/joomla-component-vbizz-remote-code-executionmitrethird-party-advisory
- wdmtech.commitreproduct
- extensions.joomla.org/extensions/extension/marketing/crm/vbizz/mitreproduct
News mentions
0No linked articles in our index yet.