Security - Arbitrary Change Profile Picture

[thatsa9]

Describe

This vulnerability allows authenticated users to change other user's profile pictures.

Steps to reproduce the vulnerability

1. Tried to login via Administrator privilege. We found 3 accounts.
   
   

Moreover, we can access directly to Profile Pictures like this
http://site-name/bludit/bl-content/uploads/profiles/[username].png

2. Tried to login via limit privilege (username: admon2, role: Editor).
   

From a HTTP Request to perform to change a user picture.

We could change the username to another username.

As a result, we could change to the profile picture of another user.

Login with Administrator to verify the change via username “admin” and found a profile picture has changed.

In addition, we could arbitrarily create a picture (png) to other directories.

Comments
The vulnerability doesn't validate an authorization before the upload process. Moreover, it could be pulled username from trusted source

Bludit version

Affected in Bludit v3.10.0

PHP version

PHP Version 7.1.33

[dignajar]

I will check, thank you!

[dignajar]

Fixed, thank you