Incorrect Access Control in Veno File Manager Project Allows SMTP Email Sending

Executive Summary

This vulnerability is an incorrect access control issue in Veno File Manager Project version 4.4.9. It allows an unauthenticated attacker to send emails from the application's configured SMTP server by making a POST request to the /vfm-admin/ajax/sendfiles.php endpoint with specific parameters and headers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /vfm-admin/ajax/sendfiles.php with parameters and headers typically used for SMTP email sending. Check server logs for unauthorized email activity originating from the application.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to send unauthorized emails, potentially using your server's resources, spamming recipients, or impersonating your organization. This could damage reputation, lead to blacklisting of your SMTP server, or result in legal consequences depending on the content of the emails sent.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR if personal data is exposed through unauthorized emails. For HIPAA, if the application handles protected health information, unauthorized email transmission could violate confidentiality requirements. Both standards require strict access controls and audit trails.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Veno File Manager Project to the latest version if available. Temporarily restrict access to /vfm-admin/ajax/sendfiles.php via server configuration until patched. Review SMTP server logs for any signs of exploitation.

Useful 0 Not Useful 0