Privilege Escalation in Vvveb CMS Product Questions

Executive Summary

This vulnerability in Vvveb CMS prior to 1.0.8.4 allows a low-privileged Vendor to manipulate product questions under another Vendor's products. The issue occurs because the backend product question operations do not verify if the product_question.product_id matches the product.admin_id for the current admin_id. This enables an attacker to read pending questions, change statuses, edit content, or delete questions, affecting product Q&A visibility and integrity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper access control in Vvveb's product question management. To detect it, check if your Vvveb version is below 1.0.8.4. Review database procedures in admin/sql/product_question.sql for admin_id validation. Test by attempting to access or modify product questions using another vendor's product_question_id.

Useful 0 Not Useful 0

Impact Analysis

If you are a Vvveb CMS user or administrator, this vulnerability could allow unauthorized users to alter product Q&A sections, potentially spreading misinformation, deleting legitimate questions, or manipulating product visibility. For vendors, this could lead to reputational damage or loss of customer trust due to tampered product information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance with GDPR or HIPAA if it leads to unauthorized access or alteration of sensitive product-related data, such as customer questions or moderation details. Unauthorized changes could violate data integrity requirements under these regulations, potentially resulting in legal or regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vvveb to version 1.0.8.4 or later to address the vulnerability. Review and restrict access controls for product question operations to ensure proper product_id and admin_id verification.

Useful 0 Not Useful 0